Re: [PATCH] ath9k_htc: fix uninit value bugs

[Kalle Valo]

Pavel Skripkin <paskripkin@xxxxxxxxx> wrote:

> Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing
> field initialization.
> 
> In htc_connect_service() svc_meta_len and pad are not initialized. Based
> on code it looks like in current skb there is no service data, so simply
> initialize svc_meta_len to 0.
> 
> htc_issue_send() does not initialize htc_frame_hdr::control array. Based
> on firmware code, it will initialize it by itself, so simply zero whole
> array to make KMSAN happy
> 
> Fail logs:
> 
> BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
>  usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
>  hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
>  hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
>  htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
>  htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
> ...
> 
> Uninit was created at:
>  slab_post_alloc_hook mm/slab.h:524 [inline]
>  slab_alloc_node mm/slub.c:3251 [inline]
>  __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
>  kmalloc_reserve net/core/skbuff.c:354 [inline]
>  __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
>  alloc_skb include/linux/skbuff.h:1126 [inline]
>  htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
> ...
> 
> Bytes 4-7 of 18 are uninitialized
> Memory access of size 18 starts at ffff888027377e00
> 
> BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
>  usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430
>  hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline]
>  hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479
>  htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline]
>  htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275
> ...
> 
> Uninit was created at:
>  slab_post_alloc_hook mm/slab.h:524 [inline]
>  slab_alloc_node mm/slub.c:3251 [inline]
>  __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974
>  kmalloc_reserve net/core/skbuff.c:354 [inline]
>  __alloc_skb+0x545/0xf90 net/core/skbuff.c:426
>  alloc_skb include/linux/skbuff.h:1126 [inline]
>  htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258
> ...
> 
> Bytes 16-17 of 18 are uninitialized
> Memory access of size 18 starts at ffff888027377e00
> 
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Reported-by: syzbot+f83a1df1ed4f67e8d8ad@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Pavel Skripkin <paskripkin@xxxxxxxxx>

How did you test this? As syzbot is mentioned I assume you did not test this on
a real device, it would help a lot if this is clearly mentioned in the commit
log. My trust on syzbot fixes is close to zero due to bad past history.

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20220115122733.11160-1-paskripkin@xxxxxxxxx/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches