diff mbox series

[1/2,v2] wifi: ath9k: avoid using uninitialized array

Message ID 20230620080855.396851-1-dmantipov@yandex.ru (mailing list archive)
State Accepted
Commit 90f2ba4896e289ba7973a5349cbad4463c97e321
Delegated to: Kalle Valo
Headers show
Series [1/2,v2] wifi: ath9k: avoid using uninitialized array | expand

Commit Message

Dmitry Antipov June 20, 2023, 8:08 a.m. UTC
In 'ath_tx_count_frames()', 'ba' array may be used uninitialized, so
add 'memset()' call similar to one used in 'ath_tx_complete_aggr()'.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
 drivers/net/wireless/ath/ath9k/xmit.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Toke Høiland-Jørgensen June 20, 2023, 12:05 p.m. UTC | #1
Dmitry Antipov <dmantipov@yandex.ru> writes:

> In 'ath_tx_count_frames()', 'ba' array may be used uninitialized, so
> add 'memset()' call similar to one used in 'ath_tx_complete_aggr()'.
>
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>

Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Kalle Valo July 25, 2023, 2:28 p.m. UTC | #2
Dmitry Antipov <dmantipov@yandex.ru> wrote:

> In 'ath_tx_count_frames()', 'ba' array may be used uninitialized, so
> add 'memset()' call similar to one used in 'ath_tx_complete_aggr()'.
> 
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>

2 patches applied to ath-next branch of ath.git, thanks.

90f2ba4896e2 wifi: ath9k: avoid using uninitialized array
810e41cebb6c wifi: ath9k: fix fortify warnings
diff mbox series

Patch

diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index f6f2ab7a63ff..8babaaacacf5 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -466,6 +466,8 @@  static void ath_tx_count_frames(struct ath_softc *sc, struct ath_buf *bf,
 	*nframes = 0;
 
 	isaggr = bf_isaggr(bf);
+	memset(ba, 0, WME_BA_BMP_SIZE >> 3);
+
 	if (isaggr) {
 		seq_st = ts->ts_seqnum;
 		memcpy(ba, &ts->ba_low, WME_BA_BMP_SIZE >> 3);