Hi,
Static analysis with Coverity on linux-next has found an issue with the
following commit:
commit 1c099ab44727c8e42fe4de4d91b53cec3ef02860
Author: Sean Wang <[email protected]>
Date: Thu Jan 28 03:33:39 2021 +0800
mt76: mt7921: add MCU support
The analysis is as follows:
390 static void
391 mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb,
392 u16 wlan_idx)
393 {
394 struct mt7921_mcu_wlan_info_event *wtbl_info =
395 (struct mt7921_mcu_wlan_info_event *)(skb->data);
396 struct rate_info rate = {};
397 u8 curr_idx = wtbl_info->rate_info.rate_idx;
398 u16 curr = le16_to_cpu(wtbl_info->rate_info.rate[curr_idx]);
399 struct mt7921_mcu_peer_cap peer = wtbl_info->peer_cap;
400 struct mt76_phy *mphy = &dev->mphy;
1. var_decl: Declaring variable stats without initializer.
401 struct mt7921_sta_stats *stats;
402 struct mt7921_sta *msta;
403 struct mt76_wcid *wcid;
404
2. Condition wlan_idx >= 288, taking false branch.
405 if (wlan_idx >= MT76_N_WCIDS)
406 return;
3. Condition 0 /* !((((sizeof ((*dev).mt76.wcid[wlan_idx]) == sizeof
(char) || sizeof ((*dev).mt76.wcid[wlan_idx]) == sizeof (short)) ||
sizeof ((*dev).mt76.wcid[wlan_idx]) == sizeof (int)) || sizeof
((*dev).mt76.wcid[wlan_idx]) == sizeof (long)) || sizeof
((*dev).mt76.wcid[wlan_idx]) == sizeof (long long)) */, taking false branch.
4. Condition debug_lockdep_rcu_enabled(), taking true branch.
5. Condition !__warned, taking true branch.
6. Condition 0, taking false branch.
7. Condition rcu_read_lock_held(), taking false branch.
407 wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
8. Condition !wcid, taking true branch.
408 if (!wcid) {
Uninitialized pointer write (UNINIT)
9. uninit_use: Using uninitialized value stats.
409 stats->tx_rate = rate;
410 return;
411 }
Line 409 dereferences pointer stats, however, this pointer has not yet
been initialized. The initialization occurs later:
413 msta = container_of(wcid, struct mt7921_sta, wcid);
414 stats = &msta->stats;
Colin
> Hi,
>
Hi Colin,
a fix for this issue has been already posted upstream:
https://patchwork.kernel.org/project/linux-wireless/patch/857ff74f736d4e593f5ad602cee7ac67ebfca5ca.1612867656.git.lorenzo@kernel.org/
Regards,
Lorenzo
> Static analysis with Coverity on linux-next has found an issue with the
> following commit:
>
> commit 1c099ab44727c8e42fe4de4d91b53cec3ef02860
> Author: Sean Wang <[email protected]>
> Date: Thu Jan 28 03:33:39 2021 +0800
>
> mt76: mt7921: add MCU support
>
> The analysis is as follows:
>
> 390 static void
> 391 mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb,
> 392 u16 wlan_idx)
> 393 {
> 394 struct mt7921_mcu_wlan_info_event *wtbl_info =
> 395 (struct mt7921_mcu_wlan_info_event *)(skb->data);
> 396 struct rate_info rate = {};
> 397 u8 curr_idx = wtbl_info->rate_info.rate_idx;
> 398 u16 curr = le16_to_cpu(wtbl_info->rate_info.rate[curr_idx]);
> 399 struct mt7921_mcu_peer_cap peer = wtbl_info->peer_cap;
> 400 struct mt76_phy *mphy = &dev->mphy;
>
> 1. var_decl: Declaring variable stats without initializer.
>
> 401 struct mt7921_sta_stats *stats;
> 402 struct mt7921_sta *msta;
> 403 struct mt76_wcid *wcid;
> 404
>
> 2. Condition wlan_idx >= 288, taking false branch.
>
> 405 if (wlan_idx >= MT76_N_WCIDS)
> 406 return;
>
> 3. Condition 0 /* !((((sizeof ((*dev).mt76.wcid[wlan_idx]) == sizeof
> (char) || sizeof ((*dev).mt76.wcid[wlan_idx]) == sizeof (short)) ||
> sizeof ((*dev).mt76.wcid[wlan_idx]) == sizeof (int)) || sizeof
> ((*dev).mt76.wcid[wlan_idx]) == sizeof (long)) || sizeof
> ((*dev).mt76.wcid[wlan_idx]) == sizeof (long long)) */, taking false branch.
>
> 4. Condition debug_lockdep_rcu_enabled(), taking true branch.
> 5. Condition !__warned, taking true branch.
> 6. Condition 0, taking false branch.
> 7. Condition rcu_read_lock_held(), taking false branch.
> 407 wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
> 8. Condition !wcid, taking true branch.
> 408 if (!wcid) {
>
> Uninitialized pointer write (UNINIT)
> 9. uninit_use: Using uninitialized value stats.
>
> 409 stats->tx_rate = rate;
> 410 return;
> 411 }
>
> Line 409 dereferences pointer stats, however, this pointer has not yet
> been initialized. The initialization occurs later:
>
> 413 msta = container_of(wcid, struct mt7921_sta, wcid);
> 414 stats = &msta->stats;
>
> Colin