rt2x00: type bug in _rt2500usb_register_read()
Subsystems (2)
PATCH 1/1 rt2x00: type bug in _rt2500usb_register_read()
This code causes a static checker bug.
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:232 _rt2500usb_register_read()
warn: passing casted pointer 'value' to 'rt2500usb_register_read()' 32 vs 16.
If the low 16 bits were initialized to zero then this code would only be a problem on big endian systems. But in this case this is case the low 16 bits are never initialized. This is called from a function which is created using a macro:
RT2X00DEBUGFS_OPS(csr, "0x%.8x\n", u32);
We end up copying uninitialized data to the user which is bogus and an information leak.
---
Not tested. Perhaps we should just remove this code since it has never worked.
drivers/net/wireless/ralink/rt2x00/rt2500usb.c +4 -1
@@ -229,7 +229,10 @@ static void _rt2500usb_register_read(struct rt2x00_dev *rt2x00dev,const unsigned int offset, u32 *value) { - rt2500usb_register_read(rt2x00dev, offset, (u16 *)value); + u16 tmp; + +rt2500usb_register_read (rt2x00dev, offset, &tmp); + *value = tmp; } static void _rt2500usb_register_write(struct rt2x00_dev *rt2x00dev,
Am 26.11.2015 12:55, schrieb Dan Carpenter:
Quoted 25 lines
This code causes a static checker bug.
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:232_rt2500usb_register_read()
warn: passing casted pointer 'value' to 'rt2500usb_register_read()' 32 vs 16.If the low 16 bits were initialized to zero then this code would only be a problem on big endian systems. But in this case this is case the low 16 bits are never initialized. This is called from a function which is created using a macro:
RT2X00DEBUGFS_OPS(csr, "0x%.8x\n", u32);We end up copying uninitialized data to the user which is bogus and an information leak.
Signed-off-by Dan Carpenter <[email protected]>---
Not tested. Perhaps we should just remove this code since it has never worked.drivers/net/wireless/ralink/rt2x00/rt2500usb.c +0
-0
drivers/net/wireless/ralink/rt2x00/rt2500usb.c static void _rt2500usb_register_read(struct rt2x00_dev *rt2x00dev, · line 237
Quoted 10 lines
drivers/net/wireless/ralink/rt2x00/rt2500usb.c +4
-1@@ -229,7 +229,10 @@ static void _rt2500usb_register_read(struct rt2x00_dev *rt2x00dev,const unsigned int offset, u32 *value) { - rt2500usb_register_read(rt2x00dev, offset, (u16 *)value); + u16 tmp; + +rt2500usb_register_read (rt2x00dev, offset, &tmp); + *value = tmp; }
perhaps, cleaning *value would be sufficient ? Avoiding the need for a tmp var.
*value = 0rt2500usb_register_read(rt2x00dev, offset, (u16 *)value);
re,
wh
Quoted 6 lines
drivers/net/wireless/ralink/rt2x00/rt2500usb.c +0
-1static void _rt2500usb_register_write(struct rt2x00_dev *rt2x00dev, --To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Quoted 8 lines · walter harms
Quoted 2 lines
If the low 16 bits were initialized to zero then this code would only be a problem on big endian systems.
perhaps, cleaning *value would be sufficient ? Avoiding the need for a tmp var.
*value = 0
rt2500usb_register_read(rt2x00dev, offset, (u16 *)value);
Because if you initialize value then you still have a bug on big endian systems.
regards,
dan carpenter
Quoted 10 lines · Dan Carpenter
This code causes a static checker bug.
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:232_rt2500usb_register_read()
warn: passing casted pointer 'value' to 'rt2500usb_register_read()' 32 vs 16.If the low 16 bits were initialized to zero then this code would only be a problem on big endian systems. But in this case this is case the low 16 bits are never initialized. This is called from a function which is created using a macro:
Quoted 6 lines
RT2X00DEBUGFS_OPS(csr, "0x%.8x\n", u32);We end up copying uninitialized data to the user which is bogus and an information leak.
Signed-off-by Dan Carpenter <[email protected]>
Quoted 3 lines
---
Not tested. Perhaps we should just remove this code since it has never worked.
It is used for debugfs interface and I would like to keep it.
Stanislaw
Kalle Valo
AppliedQuoted 11 lines
This code causes a static checker bug.
drivers/net/wireless/ralink/rt2x00/rt2500usb.c:232_rt2500usb_register_read()
warn: passing casted pointer 'value' to 'rt2500usb_register_read()' 32 vs 16.If the low 16 bits were initialized to zero then this code would only be a problem on big endian systems. But in this case this is case the low 16 bits are never initialized. This is called from a function which is created using a macro:
Quoted 7 lines
RT2X00DEBUGFS_OPS(csr, "0x%.8x\n", u32);We end up copying uninitialized data to the user which is bogus and an information leak.
Signed-off-by Dan Carpenter <[email protected]>
Thanks, applied to wireless-drivers-next.git.
Kalle Valo