All of lore.kernel.org
 help / color / mirror / Atom feed
From: Alexander Potapenko <glider@google.com>
To: glider@google.com
Cc: ath9k-devel@qca.qualcomm.com, davem@davemloft.net,
	kuba@kernel.org, kvalo@codeaurora.org,
	linux-kernel@vger.kernel.org, linux-wireless@vger.kernel.org,
	netdev@vger.kernel.org,
	syzbot+2ca247c2d60c7023de7f@syzkaller.appspotmail.com
Subject: [PATCH] ath9k: fix an uninit value use in ath9k_htc_rx_msg()
Date: Thu, 25 Aug 2022 10:05:55 +0200	[thread overview]
Message-ID: <20220825080555.3643572-1-glider@google.com> (raw)

ath9k_htc_rx_msg() assumes skb->data contains a full
`struct htc_frame_hdr`, thus it needs a call to pskb_may_pull()
to ensure there is enough data.

This fixes a long-standing issue reported by KMSAN:

  BUG: KMSAN: uninit-value in ath9k_htc_rx_msg+0x544/0x980 drivers/net/wireless/ath/ath9k/htc_hst.c:417
   ath9k_htc_rx_msg+0x544/0x980 drivers/net/wireless/ath/ath9k/htc_hst.c:417
   ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:653 [inline]
   ath9k_hif_usb_rx_cb+0x196a/0x1f10 drivers/net/wireless/ath/ath9k/hif_usb.c:686
   __usb_hcd_giveback_urb+0x522/0x740 drivers/usb/core/hcd.c:1670
   usb_hcd_giveback_urb+0x150/0x620 drivers/usb/core/hcd.c:1747
   dummy_timer+0xd3f/0x4f20 drivers/usb/gadget/udc/dummy_hcd.c:1988
   call_timer_fn+0x43/0x480 kernel/time/timer.c:1474
   expire_timers+0x272/0x610 kernel/time/timer.c:1519
   __run_timers+0x5bc/0x8c0 kernel/time/timer.c:1790
  ...

  Uninit was created at:
  ...
   __alloc_skb+0x34a/0xd70 net/core/skbuff.c:426
   __netdev_alloc_skb+0x126/0x780 net/core/skbuff.c:494
   __dev_alloc_skb include/linux/skbuff.h:3264 [inline]
   ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:635 [inline]
   ath9k_hif_usb_rx_cb+0xe7b/0x1f10 drivers/net/wireless/ath/ath9k/hif_usb.c:686
   __usb_hcd_giveback_urb+0x522/0x740 drivers/usb/core/hcd.c:1670
  ...

Reported-by: syzbot+2ca247c2d60c7023de7f@syzkaller.appspotmail.com
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Signed-off-by: Alexander Potapenko <glider@google.com>
---
 drivers/net/wireless/ath/ath9k/htc_hst.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 994ec48b2f669..83a1d2fba2218 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -408,7 +408,8 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
 	struct htc_endpoint *endpoint;
 	__be16 *msg_id;
 
-	if (!htc_handle || !skb)
+	if (!htc_handle || !skb ||
+	    !pskb_may_pull(skb, sizeof(struct htc_frame_hdr)))
 		return;
 
 	htc_hdr = (struct htc_frame_hdr *) skb->data;
-- 
2.37.2.672.g94769d06f0-goog


             reply	other threads:[~2022-08-25  8:06 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-08-25  8:05 Alexander Potapenko [this message]
2022-10-07 17:37 ` [PATCH] ath9k: fix an uninit value use in ath9k_htc_rx_msg() Toke Høiland-Jørgensen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220825080555.3643572-1-glider@google.com \
    --to=glider@google.com \
    --cc=ath9k-devel@qca.qualcomm.com \
    --cc=davem@davemloft.net \
    --cc=kuba@kernel.org \
    --cc=kvalo@codeaurora.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=syzbot+2ca247c2d60c7023de7f@syzkaller.appspotmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.