From: Kalle Valo <kvalo@kernel.org>
To: Fedor Pchelkin <pchelkin@ispras.ru>
Cc: "Toke Høiland-Jørgensen" <toke@toke.dk>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Senthil Balasubramanian" <senthilkumar@atheros.com>,
"John W. Linville" <linville@tuxdriver.com>,
"Vasanthakumar Thiagarajan" <vasanth@atheros.com>,
Sujith <Sujith.Manoharan@atheros.com>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org,
"Alexey Khoroshilov" <khoroshilov@ispras.ru>,
lvc-project@linuxtesting.org,
syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com
Subject: Re: [PATCH 1/3] wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
Date: Fri, 17 Mar 2023 07:26:11 +0200 [thread overview]
Message-ID: <871qlovtho.fsf@kernel.org> (raw)
In-Reply-To: <20230315202112.163012-2-pchelkin@ispras.ru> (Fedor Pchelkin's message of "Wed, 15 Mar 2023 23:21:10 +0300")
Fedor Pchelkin <pchelkin@ispras.ru> writes:
> For the reasons described in commit b383e8abed41 ("wifi: ath9k: avoid
> uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
> validate pkt_len before accessing the SKB. For example, the obtained SKB
> may have uninitialized memory in the case of
> ioctl(USB_RAW_IOCTL_EP_WRITE).
>
> Implement sanity checking inside the corresponding endpoint RX handlers:
> ath9k_wmi_ctrl_rx() and ath9k_htc_rxep(). Otherwise, uninit memory can
> be referenced.
>
> Add comments briefly describing the issue.
>
> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
It would be also nice to know how you have tested these. Syzkaller is no
substitute for testing on a real hardware.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
next prev parent reply other threads:[~2023-03-17 5:26 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-15 20:21 [PATCH 0/3] wifi: ath9k: deal with uninit memory Fedor Pchelkin
2023-03-15 20:21 ` [PATCH 1/3] wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx Fedor Pchelkin
2023-03-17 5:26 ` Kalle Valo [this message]
2023-03-18 20:25 ` Fedor Pchelkin
2023-04-24 18:23 ` Fedor Pchelkin
2023-04-24 18:33 ` [PATCH v2] " Fedor Pchelkin
2023-04-25 11:14 ` Toke Høiland-Jørgensen
2023-04-28 16:52 ` Kalle Valo
2023-03-15 20:21 ` [PATCH 2/3] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Fedor Pchelkin
2023-04-24 19:11 ` Fedor Pchelkin
2023-04-24 19:18 ` [PATCH v2] " Fedor Pchelkin
[not found] ` <20230425033832.2041-1-hdanton@sina.com>
2023-04-25 5:45 ` Kalle Valo
2023-04-25 7:54 ` Fedor Pchelkin
2023-04-25 19:26 ` [PATCH v3 1/2] " Fedor Pchelkin
2023-04-25 19:26 ` [PATCH v3 2/2] wifi: ath9k: protect WMI command response buffer replacement with a lock Fedor Pchelkin
2023-08-08 14:07 ` Toke Høiland-Jørgensen
[not found] ` <20230425230708.2132-1-hdanton@sina.com>
2023-04-26 19:02 ` [PATCH v3 1/2] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Fedor Pchelkin
2023-05-15 12:06 ` Toke Høiland-Jørgensen
2023-05-18 10:24 ` Hillf Danton
2023-05-18 15:44 ` Fedor Pchelkin
2023-08-08 14:06 ` Toke Høiland-Jørgensen
2023-08-22 13:35 ` Kalle Valo
2023-03-15 20:21 ` [PATCH 3/3] wifi: ath9k: fix ath9k_wmi_cmd return value when device is unplugged Fedor Pchelkin
2023-03-15 20:47 ` [PATCH 0/3] wifi: ath9k: deal with uninit memory Fedor Pchelkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=871qlovtho.fsf@kernel.org \
--to=kvalo@kernel.org \
--cc=Sujith.Manoharan@atheros.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=khoroshilov@ispras.ru \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=lvc-project@linuxtesting.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pchelkin@ispras.ru \
--cc=senthilkumar@atheros.com \
--cc=syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com \
--cc=toke@toke.dk \
--cc=vasanth@atheros.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.