From patchwork Tue Sep 5 18:15:50 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Colin Ian King X-Patchwork-Id: 810237 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3xmvzW0DxSz9t16 for ; Wed, 6 Sep 2017 04:16:06 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752459AbdIESPz (ORCPT ); Tue, 5 Sep 2017 14:15:55 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:53018 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752230AbdIESPx (ORCPT ); Tue, 5 Sep 2017 14:15:53 -0400 Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1dpIO7-00076C-2R; Tue, 05 Sep 2017 18:15:51 +0000 From: Colin King To: Kalle Valo , linux-wireless@vger.kernel.org, b43-dev@lists.infradead.org, netdev@vger.kernel.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 1/2] b43: fix unitialized reads of ret by initializing the array to zero Date: Tue, 5 Sep 2017 19:15:50 +0100 Message-Id: <20170905181550.23839-1-colin.king@canonical.com> X-Mailer: git-send-email 2.14.1 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Colin Ian King The u8 char array ret is not being initialized and elements outside the range start to end contain just garbage values from the stack. This results in a later scan of the array to read potentially uninitialized values. Fix this by initializing the array to zero. This seems to have been an issue since the very first commit. Detected by CoverityScan CID#139652 ("Uninitialized scalar variable") Signed-off-by: Colin Ian King Reviewed-by: Michael Buesch --- drivers/net/wireless/broadcom/b43/phy_g.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/b43/phy_g.c b/drivers/net/wireless/broadcom/b43/phy_g.c index 822dcaa8ace6..f59c02166462 100644 --- a/drivers/net/wireless/broadcom/b43/phy_g.c +++ b/drivers/net/wireless/broadcom/b43/phy_g.c @@ -2297,7 +2297,7 @@ static u8 b43_gphy_aci_detect(struct b43_wldev *dev, u8 channel) static u8 b43_gphy_aci_scan(struct b43_wldev *dev) { struct b43_phy *phy = &dev->phy; - u8 ret[13]; + u8 ret[13] = { 0 }; unsigned int channel = phy->channel; unsigned int i, j, start, end; From patchwork Tue Sep 5 18:16:58 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Colin Ian King X-Patchwork-Id: 810242 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3xmw0v66wKz9t16 for ; Wed, 6 Sep 2017 04:17:19 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752723AbdIESRG (ORCPT ); Tue, 5 Sep 2017 14:17:06 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:53045 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752681AbdIESRC (ORCPT ); Tue, 5 Sep 2017 14:17:02 -0400 Received: from 1.general.cking.uk.vpn ([10.172.193.212] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1dpIPC-00078N-Ma; Tue, 05 Sep 2017 18:16:58 +0000 From: Colin King To: Larry Finger , Kalle Valo , linux-wireless@vger.kernel.org, b43-dev@lists.infradead.org, netdev@vger.kernel.org Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/2] b43legacy: fix unitialized reads of ret by initializing the array to zero Date: Tue, 5 Sep 2017 19:16:58 +0100 Message-Id: <20170905181658.23893-1-colin.king@canonical.com> X-Mailer: git-send-email 2.14.1 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Colin Ian King The u8 char array ret is not being initialized and elements outside the range start to end contain just garbage values from the stack. This results in a later scan of the array to read potentially uninitialized values. Fix this by initializing the array to zero. This seems to have been an issue since the very first commit. Detected by CoverityScan CID#139653 ("Uninitialized scalar variable") Signed-off-by: Colin Ian King Reviewed-by: Michael Buesch --- drivers/net/wireless/broadcom/b43legacy/radio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/b43legacy/radio.c b/drivers/net/wireless/broadcom/b43legacy/radio.c index 9501420340a9..eab1c9387846 100644 --- a/drivers/net/wireless/broadcom/b43legacy/radio.c +++ b/drivers/net/wireless/broadcom/b43legacy/radio.c @@ -280,7 +280,7 @@ u8 b43legacy_radio_aci_detect(struct b43legacy_wldev *dev, u8 channel) u8 b43legacy_radio_aci_scan(struct b43legacy_wldev *dev) { struct b43legacy_phy *phy = &dev->phy; - u8 ret[13]; + u8 ret[13] = { 0 }; unsigned int channel = phy->channel; unsigned int i; unsigned int j;