Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1726912 > unrolled thread

[PATCH 2/2] b43legacy: fix unitialized reads of ret by initializing the array to zero

Started byColin King <colin.king@canonical.com>
First post2017-09-05 20:20 +0200
Last post2017-09-05 23:00 +0200
Articles 2 — 2 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH 2/2] b43legacy: fix unitialized reads of ret by initializing the array to zero Colin King <colin.king@canonical.com> - 2017-09-05 20:20 +0200
    Re: [PATCH 2/2] b43legacy: fix unitialized reads of ret by  initializing the array to zero Michael Büsch <m@bues.ch> - 2017-09-05 23:00 +0200

#1726912 — [PATCH 2/2] b43legacy: fix unitialized reads of ret by initializing the array to zero

FromColin King <colin.king@canonical.com>
Date2017-09-05 20:20 +0200
Subject[PATCH 2/2] b43legacy: fix unitialized reads of ret by initializing the array to zero
Message-ID<umqC6-6kM-5@gated-at.bofh.it>
From: Colin Ian King <colin.king@canonical.com>

The u8 char array ret is not being initialized and elements outside
the range start to end contain just garbage values from the stack.
This results in a later scan of the array to read potentially
uninitialized values.  Fix this by initializing the array to zero.
This seems to have been an issue since the very first commit.

Detected by CoverityScan CID#139653 ("Uninitialized scalar variable")

Signed-off-by: Colin Ian King <colin.king@canonical.com>
---
 drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c
index 9501420340a9..eab1c9387846 100644
--- a/drivers/net/wireless/broadcom/b43legacy/radio.c
+++ b/drivers/net/wireless/broadcom/b43legacy/radio.c
@@ -280,7 +280,7 @@ u8 b43legacy_radio_aci_detect(struct b43legacy_wldev *dev, u8 channel)
 u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev)
 {
 	struct b43legacy_phy *phy = &dev->phy;
-	u8 ret[13];
+	u8 ret[13] = { 0 };
 	unsigned int channel = phy->channel;
 	unsigned int i;
 	unsigned int j;
-- 
2.14.1

[toc] | [next] | [standalone]


#1726981 — Re: [PATCH 2/2] b43legacy: fix unitialized reads of ret by initializing the array to zero

FromMichael Büsch <m@bues.ch>
Date2017-09-05 23:00 +0200
SubjectRe: [PATCH 2/2] b43legacy: fix unitialized reads of ret by initializing the array to zero
Message-ID<umt6V-7Sg-3@gated-at.bofh.it>
In reply to#1726912

[Multipart message — attachments visible in raw view] — view raw

On Tue,  5 Sep 2017 19:16:58 +0100
Colin King <colin.king@canonical.com> wrote:

> From: Colin Ian King <colin.king@canonical.com>
> 
> The u8 char array ret is not being initialized and elements outside
> the range start to end contain just garbage values from the stack.
> This results in a later scan of the array to read potentially
> uninitialized values.  Fix this by initializing the array to zero.
> This seems to have been an issue since the very first commit.
> 
> Detected by CoverityScan CID#139653 ("Uninitialized scalar variable")
> 
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
>  drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c
> index 9501420340a9..eab1c9387846 100644
> --- a/drivers/net/wireless/broadcom/b43legacy/radio.c
> +++ b/drivers/net/wireless/broadcom/b43legacy/radio.c
> @@ -280,7 +280,7 @@ u8 b43legacy_radio_aci_detect(struct b43legacy_wldev *dev, u8 channel)
>  u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev)
>  {
>  	struct b43legacy_phy *phy = &dev->phy;
> -	u8 ret[13];
> +	u8 ret[13] = { 0 };
>  	unsigned int channel = phy->channel;
>  	unsigned int i;
>  	unsigned int j;


This fix seems to be correct.
Thanks for finding and fixing the issue.

Reviewed-by: Michael Buesch <m@bues.ch>



-- 
Michael

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web