From: Dan Carpenter <dan.carpenter@oracle.com>
To: xiaolinkui <xiaolinkui@gmail.com>
Cc: kvalo@kernel.org, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, gustavoars@kernel.org,
quic_jjohnson@quicinc.com, keescook@chromium.org,
johan@kernel.org, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
Linkui Xiao <xiaolinkui@kylinos.cn>
Subject: Re: [PATCH] wireless: ath6kl: fix out of bound from length.
Date: Thu, 21 Jul 2022 10:07:07 +0300 [thread overview]
Message-ID: <20220721070707.GF2316@kadam> (raw)
In-Reply-To: <20220721032158.31479-1-xiaolinkui@kylinos.cn>
On Thu, Jul 21, 2022 at 11:21:58AM +0800, xiaolinkui wrote:
> From: Linkui Xiao <xiaolinkui@kylinos.cn>
>
> If length from debug_buf.length is 4294967293 (0xfffffffd), the result of
> ALIGN(size, 4) will be 0.
>
> length = ALIGN(length, 4);
>
> In case of length == 4294967293 after four-byte aligned access, length will
> become 0.
>
> ret = ath6kl_diag_read(ar, address, buf, length);
>
> will fail to read.
It looks like "length" is untrustworthy. Generally, I kind of distrust
all endian data by default, but I dug a bit deeper and I don't trust it.
Unfortunately, if "length" is larger than ATH6KL_FWLOG_PAYLOAD_SIZE
(1500) then we are screwed. Can you add a check for that instead?
Please check my work on this because I didn't look *super* carefully.
No need to make any changes to the types, just add the upper bounds
check on ATH6KL_FWLOG_PAYLOAD_SIZE. The type changes didn't fix the bug
on 32 bit systems anyway...
regards,
dan carpenter
prev parent reply other threads:[~2022-07-21 7:07 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-21 3:21 [PATCH] wireless: ath6kl: fix out of bound from length xiaolinkui
2022-07-21 7:07 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220721070707.GF2316@kadam \
--to=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=gustavoars@kernel.org \
--cc=johan@kernel.org \
--cc=keescook@chromium.org \
--cc=kuba@kernel.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=quic_jjohnson@quicinc.com \
--cc=xiaolinkui@gmail.com \
--cc=xiaolinkui@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.