From: xiaolinkui <xiaolinkui@gmail.com>
To: kvalo@kernel.org, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, gustavoars@kernel.org,
quic_jjohnson@quicinc.com, keescook@chromium.org,
johan@kernel.org, dan.carpenter@oracle.com, xiaolinkui@gmail.com
Cc: linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, Linkui Xiao <xiaolinkui@kylinos.cn>
Subject: [PATCH] wireless: ath6kl: fix out of bound from length.
Date: Thu, 21 Jul 2022 11:21:58 +0800 [thread overview]
Message-ID: <20220721032158.31479-1-xiaolinkui@kylinos.cn> (raw)
From: Linkui Xiao <xiaolinkui@kylinos.cn>
If length from debug_buf.length is 4294967293 (0xfffffffd), the result of
ALIGN(size, 4) will be 0.
length = ALIGN(length, 4);
In case of length == 4294967293 after four-byte aligned access, length will
become 0.
ret = ath6kl_diag_read(ar, address, buf, length);
will fail to read.
Fixes: bc07ddb29a7b ("ath6kl: read fwlog from firmware ring buffer")
Signed-off-by: Linkui Xiao <xiaolinkui@kylinos.cn>
---
drivers/net/wireless/ath/ath6kl/core.h | 2 +-
drivers/net/wireless/ath/ath6kl/main.c | 5 +++--
2 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 77e052336eb5..b90ad9541e09 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -907,7 +907,7 @@ void ath6kl_cleanup_amsdu_rxbufs(struct ath6kl *ar);
int ath6kl_diag_write32(struct ath6kl *ar, u32 address, __le32 value);
int ath6kl_diag_write(struct ath6kl *ar, u32 address, void *data, u32 length);
int ath6kl_diag_read32(struct ath6kl *ar, u32 address, u32 *value);
-int ath6kl_diag_read(struct ath6kl *ar, u32 address, void *data, u32 length);
+int ath6kl_diag_read(struct ath6kl *ar, u32 address, void *data, size_t length);
int ath6kl_read_fwlogs(struct ath6kl *ar);
void ath6kl_init_profile_info(struct ath6kl_vif *vif);
void ath6kl_tx_data_cleanup(struct ath6kl *ar);
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index d3aa9e7a37c2..e9e66d5ad505 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -233,7 +233,7 @@ int ath6kl_diag_write32(struct ath6kl *ar, u32 address, __le32 value)
return 0;
}
-int ath6kl_diag_read(struct ath6kl *ar, u32 address, void *data, u32 length)
+int ath6kl_diag_read(struct ath6kl *ar, u32 address, void *data, size_t length)
{
u32 count, *buf = data;
int ret;
@@ -272,7 +272,8 @@ int ath6kl_read_fwlogs(struct ath6kl *ar)
{
struct ath6kl_dbglog_hdr debug_hdr;
struct ath6kl_dbglog_buf debug_buf;
- u32 address, length, firstbuf, debug_hdr_addr;
+ u32 address, firstbuf, debug_hdr_addr;
+ size_t length;
int ret, loop;
u8 *buf;
--
2.17.1
next reply other threads:[~2022-07-21 3:22 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-21 3:21 xiaolinkui [this message]
2022-07-21 7:07 ` [PATCH] wireless: ath6kl: fix out of bound from length Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220721032158.31479-1-xiaolinkui@kylinos.cn \
--to=xiaolinkui@gmail.com \
--cc=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=gustavoars@kernel.org \
--cc=johan@kernel.org \
--cc=keescook@chromium.org \
--cc=kuba@kernel.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=quic_jjohnson@quicinc.com \
--cc=xiaolinkui@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.