diff options
author | Felix Fietkau <nbd@openwrt.org> | 2016-01-28 22:42:10 +0000 |
---|---|---|
committer | Felix Fietkau <nbd@openwrt.org> | 2016-01-28 22:42:10 +0000 |
commit | 9d851f75afe071a5074ac6ca0cd4f8d4a87a7d9b (patch) | |
tree | 8aa69c15bd4f14fc0930a0a21274fb52c3f9db1e /package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch | |
parent | c426a0bf4a51a6744b973f36ce4e127e8bf93ed2 (diff) | |
download | master-187ad058-9d851f75afe071a5074ac6ca0cd4f8d4a87a7d9b.tar.gz master-187ad058-9d851f75afe071a5074ac6ca0cd4f8d4a87a7d9b.tar.bz2 master-187ad058-9d851f75afe071a5074ac6ca0cd4f8d4a87a7d9b.zip |
mac80211: merge a bunch of pending fixes
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@48536 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch')
-rw-r--r-- | package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch | 50 |
1 files changed, 50 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch b/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch new file mode 100644 index 0000000000..e78df36600 --- /dev/null +++ b/package/kernel/mac80211/patches/316-net-mac80211-agg-rx.c-fix-use-of-uninitialised-value.patch @@ -0,0 +1,50 @@ +From: Chris Bainbridge <chris.bainbridge@gmail.com> +Date: Wed, 27 Jan 2016 15:46:18 +0000 +Subject: [PATCH] net/mac80211/agg-rx.c: fix use of uninitialised values + +Use kzalloc instead of kmalloc for struct tid_ampdu_rx. Fixes: + +[ 7.976605] UBSAN: Undefined behaviour in net/mac80211/rx.c:932:29 +[ 7.976608] load of value 2 is not a valid value for type '_Bool' +[ 7.976611] CPU: 3 PID: 1134 Comm: kworker/u16:7 Not tainted 4.5.0-rc1+ #265 +[ 7.976613] Hardware name: Apple Inc. MacBookPro10,2/Mac-AFD8A9D944EA4843, BIOS MBP102.88Z.0106.B0A.1509130955 09/13/2015 +[ 7.976616] Workqueue: phy0 rt2x00usb_work_rxdone +[ 7.976619] 0000000000000004 ffff880254a7ba50 ffffffff8181d866 0000000000000007 +[ 7.976622] ffff880254a7ba78 ffff880254a7ba68 ffffffff8188422d ffffffff8379b500 +[ 7.976626] ffff880254a7bab8 ffffffff81884747 0000000000000202 0000000348620032 +[ 7.976629] Call Trace: +[ 7.976633] [<ffffffff8181d866>] dump_stack+0x45/0x5f +[ 7.976637] [<ffffffff8188422d>] ubsan_epilogue+0xd/0x40 +[ 7.976642] [<ffffffff81884747>] __ubsan_handle_load_invalid_value+0x67/0x70 +[ 7.976646] [<ffffffff82227b4d>] ieee80211_sta_reorder_release.isra.16+0x5ed/0x730 +[ 7.976650] [<ffffffff8222ca14>] ieee80211_prepare_and_rx_handle+0xd04/0x1c00 +[ 7.976654] [<ffffffff81cb27ce>] ? usb_hcd_map_urb_for_dma+0x65e/0x960 +[ 7.976659] [<ffffffff8222db03>] __ieee80211_rx_handle_packet+0x1f3/0x750 +[ 7.976663] [<ffffffff8222e4a7>] ieee80211_rx_napi+0x447/0x990 +[ 7.976667] [<ffffffff81c5fb85>] rt2x00lib_rxdone+0x305/0xbd0 +[ 7.976670] [<ffffffff811ac23f>] ? dequeue_task_fair+0x64f/0x1de0 +[ 7.976674] [<ffffffff811a1516>] ? sched_clock_cpu+0xe6/0x150 +[ 7.976678] [<ffffffff81c6c45c>] rt2x00usb_work_rxdone+0x7c/0x140 +[ 7.976682] [<ffffffff8117aef6>] process_one_work+0x226/0x860 +[ 7.976686] [<ffffffff8117b58c>] worker_thread+0x5c/0x680 +[ 7.976690] [<ffffffff8117b530>] ? process_one_work+0x860/0x860 +[ 7.976693] [<ffffffff81184f86>] kthread+0xf6/0x150 +[ 7.976697] [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310 +[ 7.976700] [<ffffffff822a94df>] ret_from_fork+0x3f/0x70 +[ 7.976703] [<ffffffff81184e90>] ? kthread_worker_fn+0x310/0x310 + +Link: https://lkml.org/lkml/2016/1/26/230 +Signed-off-by: Chris Bainbridge <chris.bainbridge@gmail.com> +--- + +--- a/net/mac80211/agg-rx.c ++++ b/net/mac80211/agg-rx.c +@@ -327,7 +327,7 @@ void __ieee80211_start_rx_ba_session(str + } + + /* prepare A-MPDU MLME for Rx aggregation */ +- tid_agg_rx = kmalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL); ++ tid_agg_rx = kzalloc(sizeof(struct tid_ampdu_rx), GFP_KERNEL); + if (!tid_agg_rx) + goto end; + |