* [PATCH] wil6210: fix potential out-of-bounds read
@ 2019-04-15 14:56 Gustavo A. R. Silva
2019-04-15 17:24 ` merez
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Gustavo A. R. Silva @ 2019-04-15 14:56 UTC (permalink / raw)
To: Maya Erez, Kalle Valo, David S. Miller, Vladimir Kondratiev
Cc: linux-wireless, wil6210, netdev, linux-kernel,
Gustavo A. R. Silva
Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h:
enum gro_result {
GRO_MERGED,
GRO_MERGED_FREE,
GRO_HELD,
GRO_NORMAL,
GRO_DROP,
GRO_CONSUMED,
};
typedef enum gro_result gro_result_t;
In case *rc* evaluates to 5, we end up having an out-of-bounds read
at drivers/net/wireless/ath/wil6210/txrx.c:821:
wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n",
len, gro_res_str[rc]);
Fix this by adding element "GRO_CONSUMED" to array gro_res_str.
Addresses-Coverity-ID: 1444666 ("Out-of-bounds read")
Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
---
drivers/net/wireless/ath/wil6210/txrx.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index 4ccfd1404458..d74837cce67f 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -750,6 +750,7 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
[GRO_HELD] = "GRO_HELD",
[GRO_NORMAL] = "GRO_NORMAL",
[GRO_DROP] = "GRO_DROP",
+ [GRO_CONSUMED] = "GRO_CONSUMED",
};
wil->txrx_ops.get_netif_rx_params(skb, &cid, &security);
--
2.21.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] wil6210: fix potential out-of-bounds read
2019-04-15 14:56 [PATCH] wil6210: fix potential out-of-bounds read Gustavo A. R. Silva
@ 2019-04-15 17:24 ` merez
2019-04-15 17:29 ` Gustavo A. R. Silva
2019-04-29 15:00 ` Kalle Valo
[not found] ` <20190429150007.69D8E60741@smtp.codeaurora.org>
2 siblings, 1 reply; 5+ messages in thread
From: merez @ 2019-04-15 17:24 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Kalle Valo, David S. Miller, Vladimir Kondratiev, linux-wireless,
wil6210, netdev, linux-kernel, linux-wireless-owner
On 2019-04-15 17:56, Gustavo A. R. Silva wrote:
> Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h:
>
> enum gro_result {
> GRO_MERGED,
> GRO_MERGED_FREE,
> GRO_HELD,
> GRO_NORMAL,
> GRO_DROP,
> GRO_CONSUMED,
> };
> typedef enum gro_result gro_result_t;
>
> In case *rc* evaluates to 5, we end up having an out-of-bounds read
> at drivers/net/wireless/ath/wil6210/txrx.c:821:
>
> wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n",
> len, gro_res_str[rc]);
>
> Fix this by adding element "GRO_CONSUMED" to array gro_res_str.
>
> Addresses-Coverity-ID: 1444666 ("Out-of-bounds read")
> Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result")
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
> ---
> drivers/net/wireless/ath/wil6210/txrx.c | 1 +
> 1 file changed, 1 insertion(+)
Reviewed-by: Maya Erez <merez@codeaurora.org>
--
Maya Erez
Qualcomm Israel, Inc. on behalf of Qualcomm Innovation Center, Inc.
The Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a
Linux Foundation Collaborative Project
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] wil6210: fix potential out-of-bounds read
2019-04-15 17:24 ` merez
@ 2019-04-15 17:29 ` Gustavo A. R. Silva
0 siblings, 0 replies; 5+ messages in thread
From: Gustavo A. R. Silva @ 2019-04-15 17:29 UTC (permalink / raw)
To: merez
Cc: Kalle Valo, David S. Miller, Vladimir Kondratiev, linux-wireless,
wil6210, netdev, linux-kernel, linux-wireless-owner
On 4/15/19 12:24 PM, merez@codeaurora.org wrote:
> On 2019-04-15 17:56, Gustavo A. R. Silva wrote:
>> Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h:
>>
>> enum gro_result {
>> GRO_MERGED,
>> GRO_MERGED_FREE,
>> GRO_HELD,
>> GRO_NORMAL,
>> GRO_DROP,
>> GRO_CONSUMED,
>> };
>> typedef enum gro_result gro_result_t;
>>
>> In case *rc* evaluates to 5, we end up having an out-of-bounds read
>> at drivers/net/wireless/ath/wil6210/txrx.c:821:
>>
>> wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n",
>> len, gro_res_str[rc]);
>>
>> Fix this by adding element "GRO_CONSUMED" to array gro_res_str.
>>
>> Addresses-Coverity-ID: 1444666 ("Out-of-bounds read")
>> Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result")
>> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
>> ---
>> drivers/net/wireless/ath/wil6210/txrx.c | 1 +
>> 1 file changed, 1 insertion(+)
>
> Reviewed-by: Maya Erez <merez@codeaurora.org>
>
Thanks, Maya.
--
Gustavo
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] wil6210: fix potential out-of-bounds read
2019-04-15 14:56 [PATCH] wil6210: fix potential out-of-bounds read Gustavo A. R. Silva
2019-04-15 17:24 ` merez
@ 2019-04-29 15:00 ` Kalle Valo
[not found] ` <20190429150007.69D8E60741@smtp.codeaurora.org>
2 siblings, 0 replies; 5+ messages in thread
From: Kalle Valo @ 2019-04-29 15:00 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Maya Erez, David S. Miller, Vladimir Kondratiev, linux-wireless,
wil6210, netdev, linux-kernel, Gustavo A. R. Silva
"Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
> Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h:
>
> enum gro_result {
> GRO_MERGED,
> GRO_MERGED_FREE,
> GRO_HELD,
> GRO_NORMAL,
> GRO_DROP,
> GRO_CONSUMED,
> };
> typedef enum gro_result gro_result_t;
>
> In case *rc* evaluates to 5, we end up having an out-of-bounds read
> at drivers/net/wireless/ath/wil6210/txrx.c:821:
>
> wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n",
> len, gro_res_str[rc]);
>
> Fix this by adding element "GRO_CONSUMED" to array gro_res_str.
>
> Addresses-Coverity-ID: 1444666 ("Out-of-bounds read")
> Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result")
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
> Reviewed-by: Maya Erez <merez@codeaurora.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
bfabdd699732 wil6210: fix potential out-of-bounds read
--
https://patchwork.kernel.org/patch/10901053/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 5+ messages in thread[parent not found: <20190429150007.69D8E60741@smtp.codeaurora.org>]
* Re: [PATCH] wil6210: fix potential out-of-bounds read
[not found] ` <20190429150007.69D8E60741@smtp.codeaurora.org>
@ 2019-04-29 15:23 ` Gustavo A. R. Silva
0 siblings, 0 replies; 5+ messages in thread
From: Gustavo A. R. Silva @ 2019-04-29 15:23 UTC (permalink / raw)
To: Kalle Valo
Cc: Maya Erez, David S. Miller, Vladimir Kondratiev, linux-wireless,
wil6210, netdev, linux-kernel
On 4/29/19 10:00 AM, Kalle Valo wrote:
> "Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:
>
>> Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h:
>>
>> enum gro_result {
>> GRO_MERGED,
>> GRO_MERGED_FREE,
>> GRO_HELD,
>> GRO_NORMAL,
>> GRO_DROP,
>> GRO_CONSUMED,
>> };
>> typedef enum gro_result gro_result_t;
>>
>> In case *rc* evaluates to 5, we end up having an out-of-bounds read
>> at drivers/net/wireless/ath/wil6210/txrx.c:821:
>>
>> wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n",
>> len, gro_res_str[rc]);
>>
>> Fix this by adding element "GRO_CONSUMED" to array gro_res_str.
>>
>> Addresses-Coverity-ID: 1444666 ("Out-of-bounds read")
>> Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result")
>> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
>> Reviewed-by: Maya Erez <merez@codeaurora.org>
>> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
>
> Patch applied to ath-next branch of ath.git, thanks.
>
> bfabdd699732 wil6210: fix potential out-of-bounds read
>
Awesome. :)
Thanks, Kalle.
--
Gustavo
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2019-04-29 15:23 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-04-15 14:56 [PATCH] wil6210: fix potential out-of-bounds read Gustavo A. R. Silva
2019-04-15 17:24 ` merez
2019-04-15 17:29 ` Gustavo A. R. Silva
2019-04-29 15:00 ` Kalle Valo
[not found] ` <20190429150007.69D8E60741@smtp.codeaurora.org>
2019-04-29 15:23 ` Gustavo A. R. Silva
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.