projects
/
openwrt
/
staging
/
blogic.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
cb150b9
)
mac80211: fix use of uninitialised values in RX aggregation
author
Chris Bainbridge
<chris.bainbridge@gmail.com>
Wed, 27 Jan 2016 15:46:18 +0000
(15:46 +0000)
committer
Johannes Berg
<johannes.berg@intel.com>
Fri, 29 Jan 2016 16:13:44 +0000
(17:13 +0100)
Use kzalloc instead of kmalloc for struct tid_ampdu_rx to
initialize the "removed" field (all others are initialized
manually). That fixes:
UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
load of value 2 is not a valid value for type '_Bool'
CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
Workqueue: phy0 rt2x00usb_work_rxdone
0000000000000004
ffff880254a7ba50
ffffffff8181d866
0000000000000007
ffff880254a7ba78
ffff880254a7ba68
ffffffff8188422d
ffffffff8379b500
ffff880254a7bab8
ffffffff81884747
0000000000000202
0000000348620032
Call Trace:
[<
ffffffff8181d866
>] dump_stack+0x45/0x5f
[<
ffffffff8188422d
>] ubsan_epilogue+0xd/0x40
[<
ffffffff81884747
>] __ubsan_handle_load_invalid_value+0x67/0x70
[<
ffffffff82227b4d
>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
[<
ffffffff8222ca14
>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
[<
ffffffff8222db03
>] __ieee80211_rx_handle_packet+0x1f3/0x750
[<
ffffffff8222e4a7
>] ieee80211_rx_napi+0x447/0x990
While at it, convert to use sizeof(*tid_agg_rx) instead.
Fixes: 788211d81bfdf ("mac80211: fix RX A-MPDU session reorder timer deletion")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
[reword commit message, use sizeof(*tid_agg_rx)]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/mac80211/agg-rx.c
patch
|
blob
|
history
diff --git
a/net/mac80211/agg-rx.c
b/net/mac80211/agg-rx.c
index 10ad4ac1fa0ba8ebd04e793595fab47d326194ce..367784be5df20f26fd3940c4608f1ea715bfddd6 100644
(file)
--- a/
net/mac80211/agg-rx.c
+++ b/
net/mac80211/agg-rx.c
@@
-291,7
+291,7
@@
void __ieee80211_start_rx_ba_session(struct sta_info *sta,
}
/* prepare A-MPDU MLME for Rx aggregation */
- tid_agg_rx = k
malloc(sizeof(struct tid_ampdu
_rx), GFP_KERNEL);
+ tid_agg_rx = k
zalloc(sizeof(*tid_agg
_rx), GFP_KERNEL);
if (!tid_agg_rx)
goto end;