releases/4.4.6/mac80211-fix-use-of-uninitialised-values-in-rx-aggregation.patch

   1 From f39ea2690bd61efec97622c48323f40ed6e16317 Mon Sep 17 00:00:00 2001
   2 From: Chris Bainbridge <chris.bainbridge@gmail.com>
   3 Date: Wed, 27 Jan 2016 15:46:18 +0000
   4 Subject: mac80211: fix use of uninitialised values in RX aggregation
   5
   6 From: Chris Bainbridge <chris.bainbridge@gmail.com>
   7
   8 commit f39ea2690bd61efec97622c48323f40ed6e16317 upstream.
   9
  10 Use kzalloc instead of kmalloc for struct tid_ampdu_rx to
  11 initialize the "removed" field (all others are initialized
  12 manually). That fixes:
  13
  14 UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29
  15 load of value 2 is not a valid value for type '_Bool'
  16 CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265
  17 Workqueue: phy0 rt2x00usb_work_rxdone
  18  0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007
  19  ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500
  20  ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032
  21 Call Trace:
  22  [<ffffffff8181d866>] dump_stack+0x45/0x5f
  23  [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40
  24  [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70
  25  [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730
  26  [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00
  27  [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750
  28  [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990
  29
  30 While at it, convert to use sizeof(*tid_agg_rx) instead.
  31
  32 Fixes: 788211d81bfdf ("mac80211: fix RX A-MPDU session reorder timer deletion")
  33 Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com>
  34 [reword commit message, use sizeof(*tid_agg_rx)]
  35 Signed-off-by: Johannes Berg <johannes.berg@intel.com>
  36 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  37
  38 ---
  39  net/mac80211/agg-rx.c |    2 +-
  40  1 file changed, 1 insertion(+), 1 deletion(-)
  41
  42 --- a/net/mac80211/agg-rx.c
  43 +++ b/net/mac80211/agg-rx.c
  44 @@ -291,7 +291,7 @@ void __ieee80211_start_rx_ba_session(str
  45         }
  46
  47         /* prepare A-MPDU MLME for Rx aggregation */
  48 -       tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL);
  49 +       tid_agg_rx = kzalloc(sizeof(*tid_agg_rx), GFP_KERNEL);
  50         if (!tid_agg_rx)
  51                 goto end;
  52