Accueil Explorer Aide
S'inscrire Connexion
wareck
/
openwrt_chaos_calmer
1
0
Fork 0
Fichiers Tickets 0 Pull Requests 0 Wiki
Branche: master
Branches Tags
openwrt_chaos_c...
/
package
/
kernel
/
mac80211
/
patches
/
316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch

316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch 2.6 KB
Lien permanent Historique Raw

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950 
  1. From: Chris Bainbridge <chris.bainbridge@gmail.com>
    2. 

  2. Date: Wed, 27 Jan 2016 15:46:18 +0000
    3. 

  3. Subject: [PATCH] net/mac80211/agg-rx.c: fix use of uninitialised values
    4. 

  4. 

  5. Use kzalloc instead of kmalloc for struct tid_ampdu_rx. Fixes:
    6. 

  6. 

  7. [    7.976605] UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
    8. 

  8. [    7.976608] load of value 2 is not a valid value for type '_Bool'
    9. 

  9. [    7.976611] CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
    10. 

  10. [    7.976613] Hardware name: Apple Inc. MacBookPro10,2/Mac-AFD8A9D944EA4843, BIOS MBP102.88Z.0106.B0A.1509130955 09/13/2015
    11. 

  11. [    7.976616] Workqueue: phy0 rt2x00usb_work_rxdone
    12. 

  12. [    7.976619]  0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007
    13. 

  13. [    7.976622]  ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500
    14. 

  14. [    7.976626]  ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032
    15. 

  15. [    7.976629] Call Trace:
    16. 

  16. [    7.976633]  [<ffffffff8181d866>] dump_stack+0x45/0x5f
    17. 

  17. [    7.976637]  [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40
    18. 

  18. [    7.976642]  [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70
    19. 

  19. [    7.976646]  [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
    20. 

  20. [    7.976650]  [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
    21. 

  21. [    7.976654]  [<ffffffff81cb27ce>] ? usb_hcd_map_urb_for_dma+0x65e/0x960
    22. 

  22. [    7.976659]  [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750
    23. 

  23. [    7.976663]  [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990
    24. 

  24. [    7.976667]  [<ffffffff81c5fb85>] rt2x00lib_rxdone+0x305/0xbd0
    25. 

  25. [    7.976670]  [<ffffffff811ac23f>] ? dequeue_task_fair+0x64f/0x1de0
    26. 

  26. [    7.976674]  [<ffffffff811a1516>] ? sched_clock_cpu+0xe6/0x150
    27. 

  27. [    7.976678]  [<ffffffff81c6c45c>] rt2x00usb_work_rxdone+0x7c/0x140
    28. 

  28. [    7.976682]  [<ffffffff8117aef6>] process_one_work+0x226/0x860
    29. 

  29. [    7.976686]  [<ffffffff8117b58c>] worker_thread+0x5c/0x680
    30. 

  30. [    7.976690]  [<ffffffff8117b530>] ? process_one_work+0x860/0x860
    31. 

  31. [    7.976693]  [<ffffffff81184f86>] kthread+0xf6/0x150
    32. 

  32. [    7.976697]  [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
    33. 

  33. [    7.976700]  [<ffffffff822a94df>] ret_from_fork+0x3f/0x70
    34. 

  34. [    7.976703]  [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310
    35. 

  35. 

  36. Link: https://lkml.org/lkml/2016/1/26/230
    37. 

  37. Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
    38. 

  38. ---
    39. 

  39. 

  40. --- a/net/mac80211/agg-rx.c
    41. 

  41. +++ b/net/mac80211/agg-rx.c
    42. 

  42. @@ -327,7 +327,7 @@ void __ieee80211_start_rx_ba_session(str
    43. 

  43.  	}
    44. 

  44.  
    45. 

  45.  	/* prepare A-MPDU MLME for Rx aggregation */
    46. 

  46. -	tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
    47. 

  47. +	tid_agg_rx = kzalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
    48. 

  48.  	if (!tid_agg_rx)
    49. 

  49.  		goto end;
    50. 

  50.  
    51.