All of lore.kernel.org
 help / color / mirror / Atom feed
From: Fedor Pchelkin <pchelkin@ispras.ru>
To: Kalle Valo <kvalo@kernel.org>
Cc: "Toke Høiland-Jørgensen" <toke@toke.dk>,
	"David S. Miller" <davem@davemloft.net>,
	"Eric Dumazet" <edumazet@google.com>,
	"Jakub Kicinski" <kuba@kernel.org>,
	"Paolo Abeni" <pabeni@redhat.com>,
	"Senthil Balasubramanian" <senthilkumar@atheros.com>,
	"John W. Linville" <linville@tuxdriver.com>,
	"Vasanthakumar Thiagarajan" <vasanth@atheros.com>,
	Sujith <Sujith.Manoharan@atheros.com>,
	linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	"Alexey Khoroshilov" <khoroshilov@ispras.ru>,
	lvc-project@linuxtesting.org,
	syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com
Subject: Re: [PATCH 1/3] wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
Date: Sat, 18 Mar 2023 23:25:16 +0300	[thread overview]
Message-ID: <20230318202516.2dpebysmo6uxilab@fpc> (raw)
In-Reply-To: <871qlovtho.fsf@kernel.org>

On Fri, Mar 17, 2023 at 07:26:11AM +0200, Kalle Valo wrote:
> 
> It would be also nice to know how you have tested these. Syzkaller is no
> substitute for testing on a real hardware.
> 

Unfortunately, currently I can't test this on real hardware so probably we
should postpone the patch discussion for some time. Roughly in a week or
two I'll be able to do some testing and try to reproduce the problem
there.

For sure this should be tested on real hardware as some issues may arise.
I sent the patch based on the commit b383e8abed41 ("wifi: ath9k: avoid
uninit memory read in ath9k_htc_rx_msg()") where it is explained
thoroughly what can lead to such behaviour. At the moment I don't see
anything in the code which can prevent that invalid scenario to happen for
endpoint callbacks path.

Actually, sanity checks for SKB length have been added everywhere inside
ath9k_htc_rx_msg() except where the endpoint callbacks are called. As for
the repro, the SKB inside ath9k_hif_usb_rx_stream() is allocated with
pkt_len=8 so it passes the 'htc_frame_hdr' check and processing in
ath9k_htc_rx_msg() but it obviously cannot be handled correctly in the
endpoint callbacks then.

  reply	other threads:[~2023-03-18 20:25 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-03-15 20:21 [PATCH 0/3] wifi: ath9k: deal with uninit memory Fedor Pchelkin
2023-03-15 20:21 ` [PATCH 1/3] wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx Fedor Pchelkin
2023-03-17  5:26   ` Kalle Valo
2023-03-18 20:25     ` Fedor Pchelkin [this message]
2023-04-24 18:23   ` Fedor Pchelkin
2023-04-24 18:33     ` [PATCH v2] " Fedor Pchelkin
2023-04-25 11:14       ` Toke Høiland-Jørgensen
2023-04-28 16:52       ` Kalle Valo
2023-03-15 20:21 ` [PATCH 2/3] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Fedor Pchelkin
2023-04-24 19:11   ` Fedor Pchelkin
2023-04-24 19:18     ` [PATCH v2] " Fedor Pchelkin
     [not found]       ` <20230425033832.2041-1-hdanton@sina.com>
2023-04-25  5:45         ` Kalle Valo
2023-04-25  7:54         ` Fedor Pchelkin
2023-04-25 19:26         ` [PATCH v3 1/2] " Fedor Pchelkin
2023-04-25 19:26           ` [PATCH v3 2/2] wifi: ath9k: protect WMI command response buffer replacement with a lock Fedor Pchelkin
2023-08-08 14:07             ` Toke Høiland-Jørgensen
     [not found]           ` <20230425230708.2132-1-hdanton@sina.com>
2023-04-26 19:02             ` [PATCH v3 1/2] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Fedor Pchelkin
2023-05-15 12:06               ` Toke Høiland-Jørgensen
2023-05-18 10:24               ` Hillf Danton
2023-05-18 15:44                 ` Fedor Pchelkin
2023-08-08 14:06           ` Toke Høiland-Jørgensen
2023-08-22 13:35           ` Kalle Valo
2023-03-15 20:21 ` [PATCH 3/3] wifi: ath9k: fix ath9k_wmi_cmd return value when device is unplugged Fedor Pchelkin
2023-03-15 20:47 ` [PATCH 0/3] wifi: ath9k: deal with uninit memory Fedor Pchelkin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20230318202516.2dpebysmo6uxilab@fpc \
    --to=pchelkin@ispras.ru \
    --cc=Sujith.Manoharan@atheros.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=khoroshilov@ispras.ru \
    --cc=kuba@kernel.org \
    --cc=kvalo@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=linville@tuxdriver.com \
    --cc=lvc-project@linuxtesting.org \
    --cc=netdev@vger.kernel.org \
    --cc=pabeni@redhat.com \
    --cc=senthilkumar@atheros.com \
    --cc=syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com \
    --cc=toke@toke.dk \
    --cc=vasanth@atheros.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.