diff mbox series

wifi: mt76: fix coverity uninit_use_in_call in mt76_connac2_reverse_frag0_hdr_trans()

Message ID 200ea97407b6f121da7ccd4567fde4b0426c5d9c.1670404791.git.deren.wu@mediatek.com
State Superseded
Headers show
Series wifi: mt76: fix coverity uninit_use_in_call in mt76_connac2_reverse_frag0_hdr_trans() | expand

Commit Message

Deren Wu Dec. 7, 2022, 9:22 a.m. UTC
The default case for frame_contorl is invalid. We should always
assign addr3 of this frame properly.

Coverity error message:
if (ieee80211_has_a4(hdr.frame_control))
(19) Event uninit_use_in_call:	Using uninitialized value "hdr".
Field "hdr.addr3" is uninitialized when calling "memcpy".
	memcpy(skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr));
else
	memcpy(skb_push(skb, sizeof(hdr) - 6), &hdr, sizeof(hdr) - 6);

Signed-off-by: Deren Wu <deren.wu@mediatek.com>
---
 drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

AngeloGioacchino Del Regno Dec. 7, 2022, 1:17 p.m. UTC | #1
Il 07/12/22 10:22, Deren Wu ha scritto:
> The default case for frame_contorl is invalid. We should always
> assign addr3 of this frame properly.
> 
> Coverity error message:
> if (ieee80211_has_a4(hdr.frame_control))
> (19) Event uninit_use_in_call:	Using uninitialized value "hdr".
> Field "hdr.addr3" is uninitialized when calling "memcpy".
> 	memcpy(skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr));
> else
> 	memcpy(skb_push(skb, sizeof(hdr) - 6), &hdr, sizeof(hdr) - 6);
> 
> Signed-off-by: Deren Wu <deren.wu@mediatek.com>

Please add the appropriate Fixes tag to this commit.

Thanks,
Angelo
Deren Wu Dec. 7, 2022, 3:31 p.m. UTC | #2
On Wed, 2022-12-07 at 14:17 +0100, AngeloGioacchino Del Regno wrote:
> Il 07/12/22 10:22, Deren Wu ha scritto:
> > The default case for frame_contorl is invalid. We should always
> > assign addr3 of this frame properly.
> > 
> > Coverity error message:
> > if (ieee80211_has_a4(hdr.frame_control))
> > (19) Event uninit_use_in_call:	Using uninitialized value
> > "hdr".
> > Field "hdr.addr3" is uninitialized when calling "memcpy".
> > 	memcpy(skb_push(skb, sizeof(hdr)), &hdr, sizeof(hdr));
> > else
> > 	memcpy(skb_push(skb, sizeof(hdr) - 6), &hdr, sizeof(hdr) - 6);
> > 
> > Signed-off-by: Deren Wu <deren.wu@mediatek.com>
> 
> Please add the appropriate Fixes tag to this commit.
> 
> Thanks,
> Angelo
> 
Thanks, Angelo. I will post a new version with Fixes tag.
diff mbox series

Patch

diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
index fd60123fb284..c8d0c84e688b 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c
@@ -930,7 +930,7 @@  int mt76_connac2_reverse_frag0_hdr_trans(struct ieee80211_vif *vif,
 		ether_addr_copy(hdr.addr4, eth_hdr->h_source);
 		break;
 	default:
-		break;
+		return -EINVAL;
 	}
 
 	skb_pull(skb, hdr_offset + sizeof(struct ethhdr) - 2);