From: Kalle Valo <kvalo@codeaurora.org>
To: Zekun Shen <bruceshenzk@gmail.com>
Cc: ath9k-devel@qca.qualcomm.com,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
"linux-wireless\@vger.kernel.org"
<linux-wireless@vger.kernel.org>
Subject: Re: [PATCH] ath9k: fix OOB read ar9300_eeprom_restore_internal
Date: Sat, 19 Jun 2021 11:48:27 +0300 [thread overview]
Message-ID: <87a6nmi6jo.fsf@codeaurora.org> (raw)
In-Reply-To: <YM1ajkPk+7ve4Ls9@Zekuns-MBP-16.fios-router.home> (Zekun Shen's message of "Fri, 18 Jun 2021 22:46:38 -0400")
+ linux-wireless
Zekun Shen <bruceshenzk@gmail.com> writes:
> Bad header can have large length field which can cause OOB.
> cptr is the last bytes for read, and the eeprom is parsed
> from high to low address. The OOB, triggered by the condition
> length > cptr could cause memory error with a read on
> negative index.
>
> There are some sanity check around length, but it is not
> compared with cptr (the remaining bytes). Here, the
> corrupted/bad EEPROM can cause panic.
>
> I was able to reproduce the crash, but I cannot find the
> log and the reproducer now. After I applied the patch, the
> bug is no longer reproducible.
>
> Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Please resubmit and cc linux-wireless list, otherwise patchwork won't
see the patch and then it will be out of my radar.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
next parent reply other threads:[~2021-06-19 8:48 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <YM1ajkPk+7ve4Ls9@Zekuns-MBP-16.fios-router.home>
2021-06-19 8:48 ` Kalle Valo [this message]
2021-06-19 13:29 [PATCH] ath9k: fix OOB read ar9300_eeprom_restore_internal Zekun Shen
2021-08-29 7:12 ` Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87a6nmi6jo.fsf@codeaurora.org \
--to=kvalo@codeaurora.org \
--cc=ath9k-devel@qca.qualcomm.com \
--cc=bruceshenzk@gmail.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.