ar9300_calibration_data_read_array silently ignores read failures leaving stack buffer uninitialized
Summary
ar9300_calibration_data_read_array iterates many single-byte reads but casts each return to (void) and unconditionally returns AH_TRUE. When per-byte read fails (address underflows below 0 on OTP/2KB-EEPROM systems) destination buffer slot left with uninitialized kernel-stack contents. In ar9300_eeprom_restore_internal_address uninitialized bytes flow into compression-header unpack checksum computation and potentially OS_MEMCPY into live EEPROM struct. On OTP-only systems (AR_SREV_HORNET/POSEIDON base_address 512) header read succeeds 4 bytes but if resulting length is large payload read partially fails checksum computed over uninitialized stack data. If stack garbage produces matching checksum (low probability non-zero across boots) uninitialized data memcpy into ahp->ah_eeprom readable via SIOCGATHDIAG/HAL_DIAG_EEPROM leaking ~1KB prior kernel stack. Also amplifier for DF-2255: if initial 4-byte header read fails word[0..3] fully uninitialized word[0]==blank check at :3905 uses garbage producing arbitrary length driving overflow. CONTRIBUTED vendored code upstream owns fix.
No comments yet.