# \[PATCH\] mac80211\_hwsim: correctly handle zero length frames - Subsystems: NETWORKING DRIVERS (WIRELESS), THE REST - Maintainers: Johannes Berg, Linus Torvalds - Status: REVIEWED ยท 1 review, 0 by maintainers - Reviewed. - 1 review trailer. - List: linux-kernel-mentees - 3 messages, 2 authors - Page: https://ratatoskr.run/linux-kernel-mentees/2021/06/1410181/t ## \[PATCH\] mac80211\_hwsim: correctly handle zero length frames - From: Anirudh Rayabharam \ - Date: 2021-06-10 16:19:48 - Message: https://ratatoskr.run/linux-kernel-mentees/2021/06/1410181.md ```text syzbot, using KMSAN, has reported an uninit-value access in hwsim_cloned_frame_received_nl(). This is happening because frame_data_len is 0. The code doesn't detect this case and blindly tries to read the frame's header. Fix this by bailing out in case frame_data_len is 0. Reported-by: Tested-by: Signed-off-by: Anirudh Rayabharam --- drivers/net/wireless/mac80211_hwsim.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c index 51ce767eaf88..ccfe40313109 100644 --- a/drivers/net/wireless/mac80211_hwsim.c +++ b/drivers/net/wireless/mac80211_hwsim.c @@ -3649,7 +3649,7 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2, if (skb == NULL) goto err; - if (frame_data_len > IEEE80211_MAX_DATA_LEN) + if (frame_data_len == 0 || frame_data_len > IEEE80211_MAX_DATA_LEN) goto err; /* Copy the data */ -- 2.26.2 _______________________________________________ Linux-kernel-mentees mailing list Linux-kernel-mentees@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees ``` ## Re: \[PATCH\] mac80211\_hwsim: correctly handle zero length frames - From: Johannes Berg \ - Date: 2021-06-18 09:36:36 - Message: https://ratatoskr.run/linux-kernel-mentees/2021/06/1418951.md ```text On Thu, 2021-06-10 at 21:49 +0530, Anirudh Rayabharam wrote: > syzbot, using KMSAN, has reported an uninit-value access in > hwsim_cloned_frame_received_nl(). This is happening because frame_data_len > is 0. The code doesn't detect this case and blindly tries to read the > frame's header. > > Fix this by bailing out in case frame_data_len is 0. This really seems quite pointless - you should bail out if the frame is too short for what we need to do, not just when it's 0. johannes _______________________________________________ Linux-kernel-mentees mailing list Linux-kernel-mentees@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees ``` ## Re: \[PATCH\] mac80211\_hwsim: correctly handle zero length frames - From: Anirudh Rayabharam \ - Date: 2021-06-23 07:26:45 - Message: https://ratatoskr.run/linux-kernel-mentees/2021/06/1423329.md ```text On Fri, Jun 18, 2021 at 11:36:16AM +0200, Johannes Berg wrote: > On Thu, 2021-06-10 at 21:49 +0530, Anirudh Rayabharam wrote: > > syzbot, using KMSAN, has reported an uninit-value access in > > hwsim_cloned_frame_received_nl(). This is happening because frame_data_len > > is 0. The code doesn't detect this case and blindly tries to read the > > frame's header. > > > > Fix this by bailing out in case frame_data_len is 0. > > This really seems quite pointless - you should bail out if the frame is > too short for what we need to do, not just when it's 0. That makes sense. Do you happen to know what the min length of a valid frame is? There doesn't seem to be constant defined for that already. - Anirudh > > johannes > _______________________________________________ Linux-kernel-mentees mailing list Linux-kernel-mentees@lists.linuxfoundation.org https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees ```