lkml.org 
[lkml]   [2021]   [Jun]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] mac80211_hwsim: correctly handle zero length frames
From
Date
On Thu, 2021-06-10 at 21:49 +0530, Anirudh Rayabharam wrote:
> syzbot, using KMSAN, has reported an uninit-value access in
> hwsim_cloned_frame_received_nl(). This is happening because frame_data_len
> is 0. The code doesn't detect this case and blindly tries to read the
> frame's header.
>
> Fix this by bailing out in case frame_data_len is 0.

This really seems quite pointless - you should bail out if the frame is
too short for what we need to do, not just when it's 0.

johannes

\
 
 \ /
  Last update: 2021-06-18 11:37    [W:0.045 / U:1.720 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site