lkml.org 
[lkml]   [2022]   [Aug]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: KMSAN: uninit-value in ath9k_htc_rx_msg
From
Hello.

I found that your patch was applied. But since the reproducer tested only 0 byte
case, I think that rejecting only less than sizeof(struct htc_frame_hdr) bytes
is not sufficient.

More complete patch with Ack from Toke is waiting at
https://lkml.kernel.org/r/7acfa1be-4b5c-b2ce-de43-95b0593fb3e5@I-love.SAKURA.ne.jp .

Please consider overriding with my version.

On 2022/08/24 22:30, Alexander Potapenko wrote:
> (adding back people originally CCed on the syzkaller bug.
> Unfortunately it isn't possible to reply to all in Google Groups)
>
> On Wed, Aug 24, 2022 at 3:26 PM Alexander Potapenko wrote:
>> This bug bites us quite often on syzbot: https://syzkaller.appspot.com/bug?id=659ddf411502a2fe220c8f9be696d5a8d8db726e (17k crashes)
>> The patch below by phil@philpotter.co.uk (https://syzkaller.appspot.com/text?tag=Patch&x=173dcb51d00000) seems to fix the problem, but I have no idea what's going on there.
>>
>> ==============================================================
>> diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
>> index 510e61e97dbc..9dbfff7a388e 100644
>> --- a/drivers/net/wireless/ath/ath9k/htc_hst.c
>> +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
>> @@ -403,7 +403,7 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
>> struct htc_endpoint *endpoint;
>> __be16 *msg_id;
>>
>> - if (!htc_handle || !skb)
>> + if (!htc_handle || !skb || !pskb_may_pull(skb, sizeof(struct htc_frame_hdr)))
>> return;
>>
>> htc_hdr = (struct htc_frame_hdr *) skb->data;
>> ==============================================================
>

>

\
 
 \ /
  Last update: 2022-08-25 16:34    [W:0.159 / U:0.416 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site