From patchwork Wed Jan 27 15:46:18 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Bainbridge X-Patchwork-Id: 8135001 X-Patchwork-Delegate: johannes@sipsolutions.net Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 68D7F9F818 for ; Wed, 27 Jan 2016 15:46:29 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 5DE8A20364 for ; Wed, 27 Jan 2016 15:46:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 16DC220204 for ; Wed, 27 Jan 2016 15:46:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754731AbcA0PqZ (ORCPT ); Wed, 27 Jan 2016 10:46:25 -0500 Received: from mail-wm0-f54.google.com ([74.125.82.54]:33858 "EHLO mail-wm0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754249AbcA0PqW (ORCPT ); Wed, 27 Jan 2016 10:46:22 -0500 Received: by mail-wm0-f54.google.com with SMTP id n5so34614665wmn.1; Wed, 27 Jan 2016 07:46:21 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=fERuf++ItalJXyagz3VQ+OAEEe/Sm508fVvDZSSlwQQ=; b=BT3wmWSm34/vjWRQtly/a0p2y6pHL6or8+GbKmZwV/ZNWXF7G/PxpW+DSeJArqVcXG MZ/inzd7iQpXFVUE7saahEN6Qb9xrzG9R+4mfHjYoNF+J4OpoFm+42vKHFfNd4xzvvcQ vfBt6icSSJe1QCPWAugRfYDgAe+K8hncOBGGz/YY5SyhTUnsQ/tiKEpIQRigRZG+693N Nl1J2Zj+ztT9rfTAEERC5enhAJS9WC9tiWufM4F2LJXpJCHxoWDCHL6jxxt3qJnmxbfh pXQThDScIpMuH0MvQXmiVeq74apKGkHLrAZZjkc+X2IbQ8xh83tvvrOkfusSl0fsh0aw J6qw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-type:content-disposition:in-reply-to :user-agent; bh=fERuf++ItalJXyagz3VQ+OAEEe/Sm508fVvDZSSlwQQ=; b=VJ+H6LIDaNU9WCk9aPWEu0UcmEHmiVcfwFOQikS2fQ5BF7g7edoINxmHPbP/14zyZ0 9GNOu7UtnUeyJvg+/QensjV8hk09+yc9CxQ6wbbI7yqD/uxTWr+KhaIKMzCBBhKU8mAW qvIe0NojqiV95RibeXRnG35yB554/xzwBpTNy9Zq6hDuu6qZgth2+Z5WRIjqtoNzIZ6G JqGD/ni+7R9+aP7dAKPDJlhSHBHarXzUoTeS9QoC1bhmwlmoqGvTWwELK0ey4viaZ/eE gb9RXmceHEsl1Di4Tqmhln21O9EgXIa6RDjCNsK89EoDijckGgiEE9wPk2AR5hRs2JRc s7RQ== X-Gm-Message-State: AG10YORWDnq32pPxKQZSXxWDnNhpA8WDkr+Rn0Opn1sDrCw4wFcCPfKaKsY6kqikJ6DbkA== X-Received: by 10.194.52.8 with SMTP id p8mr8356905wjo.62.1453909581315; Wed, 27 Jan 2016 07:46:21 -0800 (PST) Received: from localhost (cpc5-sgyl32-2-0-cust224.sgyl.cable.virginm.net. [94.174.200.225]) by smtp.gmail.com with ESMTPSA id r10sm6788999wjz.24.2016.01.27.07.46.19 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 27 Jan 2016 07:46:20 -0800 (PST) Date: Wed, 27 Jan 2016 15:46:18 +0000 From: Chris Bainbridge To: linux-kernel@vger.kernel.org Cc: johannes@sipsolutions.net, linux-wireless@vger.kernel.org, aryabinin@virtuozzo.com Subject: [PATCH] net/mac80211/agg-rx.c: fix use of uninitialised values Message-ID: <20160127154618.GA5717@localhost> References: <20160126111730.GA6765@localhost> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20160126111730.GA6765@localhost> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Use kzalloc instead of kmalloc for struct tid_ampdu_rx. Fixes: [ 7.976605] UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29 [ 7.976608] load of value 2 is not a valid value for type '_Bool' [ 7.976611] CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265 [ 7.976613] Hardware name: Apple Inc. MacBookPro10,2/Mac-AFD8A9D944EA4843, BIOS MBP102.88Z.0106.B0A.1509130955 09/13/2015 [ 7.976616] Workqueue: phy0 rt2x00usb_work_rxdone [ 7.976619] 0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007 [ 7.976622] ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500 [ 7.976626] ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032 [ 7.976629] Call Trace: [ 7.976633] [] dump_stack+0x45/0x5f [ 7.976637] [] ubsan_epilogue+0xd/0x40 [ 7.976642] [] __ubsan_handle_load_invalid_value+0x67/0x70 [ 7.976646] [] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730 [ 7.976650] [] ieee80211_prepare_and_rx_handle+0xd04/0x1c00 [ 7.976654] [] ? usb_hcd_map_urb_for_dma+0x65e/0x960 [ 7.976659] [] __ieee80211_rx_handle_packet+0x1f3/0x750 [ 7.976663] [] ieee80211_rx_napi+0x447/0x990 [ 7.976667] [] rt2x00lib_rxdone+0x305/0xbd0 [ 7.976670] [] ? dequeue_task_fair+0x64f/0x1de0 [ 7.976674] [] ? sched_clock_cpu+0xe6/0x150 [ 7.976678] [] rt2x00usb_work_rxdone+0x7c/0x140 [ 7.976682] [] process_one_work+0x226/0x860 [ 7.976686] [] worker_thread+0x5c/0x680 [ 7.976690] [] ? process_one_work+0x860/0x860 [ 7.976693] [] kthread+0xf6/0x150 [ 7.976697] [] ? kthread_worker_fn+0x310/0x310 [ 7.976700] [] ret_from_fork+0x3f/0x70 [ 7.976703] [] ? kthread_worker_fn+0x310/0x310 Link: https://lkml.org/lkml/2016/1/26/230 Signed-off-by: Chris Bainbridge Reviewed-by: Julian Calaby --- net/mac80211/agg-rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c index 10ad4ac1fa0b..bde3344cbdd0 100644 --- a/net/mac80211/agg-rx.c +++ b/net/mac80211/agg-rx.c @@ -291,7 +291,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta, } /* prepare A-MPDU MLME for Rx aggregation */ - tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL); + tid_agg_rx = kzalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL); if (!tid_agg_rx) goto end;