# Re: \[PATCH\] mac80211\_hwsim: correctly handle zero length frames

- From: Johannes Berg \<johannes@sipsolutions.net\>
- Date: 2021-06-18 09:36:36 
- List: linux-kernel-mentees
- Page: https://ratatoskr.run/linux-kernel-mentees/2021/06/1418951
- Thread: https://ratatoskr.run/linux-wireless/2021/06/1410181/t.md

```text
On Thu, 2021-06-10 at 21:49 +0530, Anirudh Rayabharam wrote:
> syzbot, using KMSAN, has reported an uninit-value access in
> hwsim_cloned_frame_received_nl(). This is happening because frame_data_len
> is 0. The code doesn't detect this case and blindly tries to read the
> frame's header.
> 
> Fix this by bailing out in case frame_data_len is 0.

This really seems quite pointless - you should bail out if the frame is
too short for what we need to do, not just when it's 0.

johannes

_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
```