lkml.org 
[lkml]   [2022]   [Jan]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH] ath9k_htc: fix uninit value bugs
    From
    Date
    Pavel Skripkin <paskripkin@gmail.com> wrote:

    > Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing
    > field initialization.
    >
    > In htc_connect_service() svc_meta_len and pad are not initialized. Based
    > on code it looks like in current skb there is no service data, so simply
    > initialize svc_meta_len to 0.
    >
    > htc_issue_send() does not initialize htc_frame_hdr::control array. Based
    > on firmware code, it will initialize it by itself, so simply zero whole
    > array to make KMSAN happy
    >
    > Fail logs:
    >
    > BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
    > usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
    > hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
    > hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
    > htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
    > htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
    > ...
    >
    > Uninit was created at:
    > slab_post_alloc_hook mm/slab.h:524 [inline]
    > slab_alloc_node mm/slub.c:3251 [inline]
    > __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
    > kmalloc_reserve net/core/skbuff.c:354 [inline]
    > __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
    > alloc_skb include/linux/skbuff.h:1126 [inline]
    > htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
    > ...
    >
    > Bytes 4-7 of 18 are uninitialized
    > Memory access of size 18 starts at ffff888027377e00
    >
    > BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
    > usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
    > hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
    > hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
    > htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
    > htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
    > ...
    >
    > Uninit was created at:
    > slab_post_alloc_hook mm/slab.h:524 [inline]
    > slab_alloc_node mm/slub.c:3251 [inline]
    > __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
    > kmalloc_reserve net/core/skbuff.c:354 [inline]
    > __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
    > alloc_skb include/linux/skbuff.h:1126 [inline]
    > htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
    > ...
    >
    > Bytes 16-17 of 18 are uninitialized
    > Memory access of size 18 starts at ffff888027377e00
    >
    > Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
    > Reported-by: syzbot+f83a1df1ed4f67e8d8ad@syzkaller.appspotmail.com
    > Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>

    How did you test this? As syzbot is mentioned I assume you did not test this on
    a real device, it would help a lot if this is clearly mentioned in the commit
    log. My trust on syzbot fixes is close to zero due to bad past history.

    --
    https://patchwork.kernel.org/project/linux-wireless/patch/20220115122733.11160-1-paskripkin@gmail.com/

    https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

    \
     
     \ /
      Last update: 2022-01-17 13:57    [W:2.424 / U:0.456 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site