From nobody Fri Dec 19 12:48:58 2025 Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACCC22FA0DD for ; Wed, 5 Nov 2025 11:50:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762343411; cv=none; b=iCfetwG30gyNS9jCwdpmpLfU/c5gpsuUkFQcUy2iZvEpFwNuQl6J2WbgrZlMcy9MN4tiofcWxcnOTXOdNPbkPGcFXjqFs48/w4FnRfkct2NHTYHr6i9ic0oBnsnnTjV8blbqDuAdrOLqDTI0cm8MgR39e6jLGyuhSBEhWBf8tUw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1762343411; c=relaxed/simple; bh=MHbng6srjLWyY3isFngCuEsAZy+dOOpmHyWZUgmX/bk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=B/lyfl/CG0I11PqzV893xFb5cz2JBa7/M+i9Z3B4kOyZcF3V3FM9dhMVyJ31p8LiKVsYAKe/CzWRfMeoJJUIiY2vXN4dlhK4yavIuL56K6gKL4Mw040TaTBXpd/nWL5FRdVyxBRo/YQVxjrIiKV+OnlD96FYGnaV6xn6M3vAi6M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=CMADRWc7; arc=none smtp.client-ip=209.85.214.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="CMADRWc7" Received: by mail-pl1-f180.google.com with SMTP id d9443c01a7336-29570bcf220so49843085ad.3 for ; Wed, 05 Nov 2025 03:50:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1762343409; x=1762948209; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=pjlBcVA0fwgfcOgXPYN9Hid6rAR5JqFICSTBhL/k5AU=; b=CMADRWc7R1lfs0D662kXOGv83isuKKIwJaTZj8NhDhxLySJ0vumTRWpupG8WETe6Jb X5aybOOuMKFkSyHOTKrF8FXqvBRsG2SG3BGv+2xuSB+WG+y5UiDiMRPWDTm34L65qiCl tSIhdF383JFPIjj777ICM/YhKV7FpbE/b5QhcUGtRBu6fl35yUMsAPsLStPfQJocC13P qCTbm4MzgBaE2pgUEXWKT/BO+5FXdqY+4akc5JVxw4e93/nIMPMjWsZ0CnbrBQoeuqpU 2FgmloRVtiJm4hiWNuW2rjO8RDNHWEwuyGn9vPq86q+LwEVRtPqwzExEU43g9E8w9/Yk VKjA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762343409; x=1762948209; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=pjlBcVA0fwgfcOgXPYN9Hid6rAR5JqFICSTBhL/k5AU=; b=eyN8tzdhMS99PLQCAbynKC0xV+w5CxfXm8k/8mWwk7s19fz1nCDKnjogL+tnS0lHXP c21WoTdw2E0Fr6mrkHSy4MpP0+iBN3mDRElK7Jiph0HbzOaGF3JPO2sB+6JHBN+HszTI TiVTY3Wfg8pDXQBGmGifQB8J4bv9502yONSPbJOlJXDI18XAGP/urKzQSQqlooJDkPDw jHF4ypGa6gK86IZZQh2Freismb5DeKjSoCXO/PvvWtVNYkw1HRPlh/4lOa5HdwBMmfZT HFWcF92YiXD1ZDQoxf6fQC+FTG0ZRNDbXTzluTrfj4QwiLqHinBnGgeaqsYB3M2Mm70M AZjw== X-Forwarded-Encrypted: i=1; AJvYcCUY3qwbKojQzOu/WaJtdkhZqALDtcZ4xlPE1PDwchHZBH401TZYxX0seP2OfLkbZ5wcg0ispuLyfljJzBQ=@vger.kernel.org X-Gm-Message-State: AOJu0YyBSWnDsdHIlSvwwe5WPaE+UobE6ouDwGBcgE0TuyBD9cFpFjQa WGoJ7696geHaOtfItfaDel+n4TrjjMPznadIVzfQ5233LuQ7YAUTxU4M X-Gm-Gg: ASbGnctSZ/ZyVLDJSr9/0K1/UfyVSgRpOd4ihHFgX+hMoCBB9+KkGbCR4jyNjYt91F5 /NFK6PdED5jzog/5pjR1pM+z6moSYhUyQd9ScJUhGUg8ACcpZ4taOWzUKZZSO7k3JbyvFLaxYTr U9B89x7+mxtAbzcN+xcIb6i+uy8zEB5kTTV2sAgWGqhKUQGej6qoYvuXqEtNi0iVl3VqZr3qoqq TvBg2H09c/IiUiLEsYkpbCvseZ3bf2+7nd1l0f2g8RO3DsMFfwyTZzR7fLAH6CiKBc3YDvK7qRz fGnhPHdVHuF4vlKykTE65YvsGdZ3c5lmHMfUD5cEUeeWjkzuD2z6HXaT7nPjXWd1tWbF+H2aXwo oCfzw2YhmfiVfR4nMAw6svOKC71Dficv932Rm+W4dEPpboxiUy/P3zEGxC5Cu/QM4k3Vx9cDsFo hG X-Google-Smtp-Source: AGHT+IHdUXKuWWISPi0q/licRMZ6Bx4YcC7Akip5kI5n3mrpw2TZuTHVRv+6VFth21ABY/rXx6TKUA== X-Received: by 2002:a17:902:dad1:b0:295:8da5:c634 with SMTP id d9443c01a7336-2962ad835bemr33691215ad.9.1762343408930; Wed, 05 Nov 2025 03:50:08 -0800 (PST) Received: from aheev.home ([2401:4900:88f4:f6c4:54cc:cfa8:7cce:97b5]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-ba1f2893bc6sm5254850a12.10.2025.11.05.03.50.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Nov 2025 03:50:08 -0800 (PST) From: Ally Heev Date: Wed, 05 Nov 2025 17:20:01 +0530 Subject: [PATCH] net: wireless: fix uninitialized pointers with free attr Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251105-aheev-uninitialized-free-attr-wireless-v1-1-6c850a4a952a@gmail.com> X-B4-Tracking: v=1; b=H4sIAOg5C2kC/x3NwQrCMBBF0V8ps3agKVbFXxEXafNiH5Qok7SKp f9ucHk2926SYUSWa7OJYWXmM1W4QyPj5NMDylAtXdv1zrW9+glYdUlMLPQzvwgaDVBfiumbhhk 56xBwPh3jgIsbpcZehsjPf3S77/sPO1TKEHgAAAA= X-Change-ID: 20251105-aheev-uninitialized-free-attr-wireless-bde764fbe81c To: Miri Korenblit Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Dan Carpenter , Ally Heev X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=openpgp-sha256; l=4084; i=allyheev@gmail.com; h=from:subject:message-id; bh=MHbng6srjLWyY3isFngCuEsAZy+dOOpmHyWZUgmX/bk=; b=owGbwMvMwCU2zXbRFfvr1TKMp9WSGDK5Ld/yJc1rO3l93pqEQosd+hcCzIMv1W7IffB8n3LY3 3upilPedpSyMIhxMciKKbIwikr56W2SmhB3OOkbzBxWJpAhDFycAjCRDbaMDOeT3l/c0rcirn7C 81NXPf4r9IdWrz5jZKwQtICRR+X3kvcM/yNWyLFNNHfn+NMTeKtG8OBdrrCsRTc3mSVfOSYunsF 9mhMA X-Developer-Key: i=allyheev@gmail.com; a=openpgp; fpr=01151A4E2EB21A905EC362F6963DA2D43FD77B1C Uninitialized pointers with `__free` attribute can cause undefined behaviour as the memory assigned(randomly) to the pointer is freed automatically when the pointer goes out of scope wireless doesn't have any bugs related to this as of now, but it is better to initialize and assign pointers with `__free` attr in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aPiG_F5EBQUjZqsl@stanley.mountain/ Signed-off-by: Ally Heev --- drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 6 +++--- drivers/net/wireless/intel/iwlwifi/mld/d3.c | 16 ++++++---------- 2 files changed, 9 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c b/drivers/net/wir= eless/intel/iwlwifi/fw/uefi.c index 4ae4d215e633e0d51194d818d479349e7c502201..7fcd76f2ef8e373f16c09ed16ad= e1ef16ccf6bed 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c +++ b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c @@ -818,11 +818,11 @@ int iwl_uefi_get_dsbr(struct iwl_fw_runtime *fwrt, u3= 2 *value) =20 int iwl_uefi_get_phy_filters(struct iwl_fw_runtime *fwrt) { - struct uefi_cnv_wpfc_data *data __free(kfree); struct iwl_phy_specific_cfg *filters =3D &fwrt->phy_filters; =20 - data =3D iwl_uefi_get_verified_variable(fwrt->trans, IWL_UEFI_WPFC_NAME, - "WPFC", sizeof(*data), NULL); + struct uefi_cnv_wpfc_data *data __free(kfree) =3D iwl_uefi_get_verified_v= ariable(fwrt->trans, + IWL_UEFI_WPFC_NAME, "WPFC", sizeof(*data), NULL); + if (IS_ERR(data)) return -EINVAL; =20 diff --git a/drivers/net/wireless/intel/iwlwifi/mld/d3.c b/drivers/net/wire= less/intel/iwlwifi/mld/d3.c index 1d4282a21f09e0f90a52dc02c8287ecc0e0fafe1..515728b8cacf4004a121183cc93= ab28b17b3bdc8 100644 --- a/drivers/net/wireless/intel/iwlwifi/mld/d3.c +++ b/drivers/net/wireless/intel/iwlwifi/mld/d3.c @@ -592,7 +592,6 @@ iwl_mld_handle_wowlan_info_notif(struct iwl_mld *mld, struct iwl_rx_packet *pkt) { const struct iwl_wowlan_info_notif *notif; - struct iwl_wowlan_info_notif *converted_notif __free(kfree) =3D NULL; u32 len =3D iwl_rx_packet_payload_len(pkt); int wowlan_info_ver =3D iwl_fw_lookup_notif_ver(mld->fw, PROT_OFFLOAD_GROUP, @@ -609,10 +608,10 @@ iwl_mld_handle_wowlan_info_notif(struct iwl_mld *mld, 5)) return true; =20 - converted_notif =3D kzalloc(struct_size(converted_notif, - mlo_gtks, - notif_v5->num_mlo_link_keys), - GFP_ATOMIC); + struct iwl_wowlan_info_notif *converted_notif __free(kfree) =3D + kzalloc(struct_size(converted_notif, mlo_gtks, notif_v5->num_mlo_link_k= eys), + GFP_ATOMIC); + if (!converted_notif) { IWL_ERR(mld, "Failed to allocate memory for converted wowlan_info_notif\n"); @@ -996,8 +995,6 @@ static void iwl_mld_mlo_rekey(struct iwl_mld *mld, struct iwl_mld_wowlan_status *wowlan_status, struct ieee80211_vif *vif) { - struct iwl_mld_old_mlo_keys *old_keys __free(kfree) =3D NULL; - IWL_DEBUG_WOWLAN(mld, "Num of MLO Keys: %d\n", wowlan_status->num_mlo_key= s); =20 if (!wowlan_status->num_mlo_keys) @@ -1785,7 +1782,8 @@ iwl_mld_send_proto_offload(struct iwl_mld *mld, struct ieee80211_vif *vif, u8 ap_sta_id) { - struct iwl_proto_offload_cmd_v4 *cmd __free(kfree); + struct iwl_proto_offload_cmd_v4 *cmd __free(kfree) =3D kzalloc(sizeof(*cm= d), + GFP_KERNEL); struct iwl_host_cmd hcmd =3D { .id =3D PROT_OFFLOAD_CONFIG_CMD, .dataflags[0] =3D IWL_HCMD_DFL_NOCOPY, @@ -1793,8 +1791,6 @@ iwl_mld_send_proto_offload(struct iwl_mld *mld, }; u32 enabled =3D 0; =20 - cmd =3D kzalloc(hcmd.len[0], GFP_KERNEL); - #if IS_ENABLED(CONFIG_IPV6) struct iwl_mld_vif *mld_vif =3D iwl_mld_vif_from_mac80211(vif); struct iwl_mld_wowlan_data *wowlan_data =3D &mld_vif->wowlan_data; --- base-commit: c9cfc122f03711a5124b4aafab3211cf4d35a2ac change-id: 20251105-aheev-uninitialized-free-attr-wireless-bde764fbe81c Best regards, --=20 Ally Heev