* [PATCH] wifi: ath9k: fix out-of-bounds endpoint index in htc_issue_send()
@ 2024-10-21 8:47 Dmitry Antipov
2024-10-21 8:55 ` Kalle Valo
2024-10-24 13:48 ` Toke Høiland-Jørgensen
0 siblings, 2 replies; 3+ messages in thread
From: Dmitry Antipov @ 2024-10-21 8:47 UTC (permalink / raw)
To: Toke Høiland-Jørgensen
Cc: Kalle Valo, linux-wireless, lvc-project, Dmitry Antipov,
syzbot+93cbd5fbb85814306ba1
Syzbot has reported the following UBSAN splat:
UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:35
index 255 is out of range for type 'struct htc_endpoint[22]'
...
Call Trace:
...
__ubsan_handle_out_of_bounds+0x115/0x140
htc_send_epid+0x1e0/0x2d0
ath9k_wmi_cmd+0x31f/0x590
ath9k_regread+0xdc/0x140
? __pfx_ath9k_regread+0x10/0x10
? _raw_spin_unlock_irqrestore+0xae/0x110
? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
? __pfx_ath9k_regread+0x10/0x10
ath9k_hw_init+0x4b0/0x2230
? init_timer_key+0x171/0x2d0
ath9k_htc_probe_device+0xa66/0x1fe0
? __pfx_ath9k_htc_probe_device+0x10/0x10
? usb_hcd_submit_urb+0x345/0x1ae0
? usb_free_urb+0x9d/0x120
? ath9k_hif_usb_alloc_urbs+0x1077/0x1150
ath9k_htc_hw_init+0x32/0x70
ath9k_hif_usb_firmware_cb+0x240/0x4c0
? __pfx_ath9k_hif_usb_firmware_cb+0x10/0x10
request_firmware_work_func+0x106/0x1c0
...
IIUC https://syzkaller.appspot.com/text?tag=ReproC&x=1734b9f1180000 makes
an attempt to emulate ath9k USB device in somewhat weird and obscure way
so I'm not sure whether this may happen on a real hardware. OTOH whether
ending with ENDPOINT_UNUSED in 'htc_connect_service()' may indicate the
malfunctioned real device, it may be better to reject such a device with
-ENODEV.
Reported-by: syzbot+93cbd5fbb85814306ba1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=93cbd5fbb85814306ba1
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
drivers/net/wireless/ath/ath9k/htc_hst.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index eb631fd3336d..4288ef5b8df5 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -295,7 +295,7 @@ int htc_connect_service(struct htc_target *target,
}
*conn_rsp_epid = target->conn_rsp_epid;
- return 0;
+ return target->conn_rsp_epid == ENDPOINT_UNUSED ? -ENODEV : 0;
err:
kfree_skb(skb);
return ret;
--
2.47.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] wifi: ath9k: fix out-of-bounds endpoint index in htc_issue_send()
2024-10-21 8:47 [PATCH] wifi: ath9k: fix out-of-bounds endpoint index in htc_issue_send() Dmitry Antipov
@ 2024-10-21 8:55 ` Kalle Valo
2024-10-24 13:48 ` Toke Høiland-Jørgensen
1 sibling, 0 replies; 3+ messages in thread
From: Kalle Valo @ 2024-10-21 8:55 UTC (permalink / raw)
To: Dmitry Antipov
Cc: Toke Høiland-Jørgensen, linux-wireless, lvc-project,
syzbot+93cbd5fbb85814306ba1
Dmitry Antipov <dmantipov@yandex.ru> writes:
> Syzbot has reported the following UBSAN splat:
>
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:35
> index 255 is out of range for type 'struct htc_endpoint[22]'
> ...
> Call Trace:
> ...
> __ubsan_handle_out_of_bounds+0x115/0x140
> htc_send_epid+0x1e0/0x2d0
> ath9k_wmi_cmd+0x31f/0x590
> ath9k_regread+0xdc/0x140
> ? __pfx_ath9k_regread+0x10/0x10
> ? _raw_spin_unlock_irqrestore+0xae/0x110
> ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
> ? __pfx_ath9k_regread+0x10/0x10
> ath9k_hw_init+0x4b0/0x2230
> ? init_timer_key+0x171/0x2d0
> ath9k_htc_probe_device+0xa66/0x1fe0
> ? __pfx_ath9k_htc_probe_device+0x10/0x10
> ? usb_hcd_submit_urb+0x345/0x1ae0
> ? usb_free_urb+0x9d/0x120
> ? ath9k_hif_usb_alloc_urbs+0x1077/0x1150
> ath9k_htc_hw_init+0x32/0x70
> ath9k_hif_usb_firmware_cb+0x240/0x4c0
> ? __pfx_ath9k_hif_usb_firmware_cb+0x10/0x10
> request_firmware_work_func+0x106/0x1c0
> ...
>
> IIUC https://syzkaller.appspot.com/text?tag=ReproC&x=1734b9f1180000 makes
> an attempt to emulate ath9k USB device in somewhat weird and obscure way
> so I'm not sure whether this may happen on a real hardware. OTOH whether
> ending with ENDPOINT_UNUSED in 'htc_connect_service()' may indicate the
> malfunctioned real device, it may be better to reject such a device with
> -ENODEV.
>
> Reported-by: syzbot+93cbd5fbb85814306ba1@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=93cbd5fbb85814306ba1
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
> drivers/net/wireless/ath/ath9k/htc_hst.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
> index eb631fd3336d..4288ef5b8df5 100644
> --- a/drivers/net/wireless/ath/ath9k/htc_hst.c
> +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
> @@ -295,7 +295,7 @@ int htc_connect_service(struct htc_target *target,
> }
>
> *conn_rsp_epid = target->conn_rsp_epid;
> - return 0;
> + return target->conn_rsp_epid == ENDPOINT_UNUSED ? -ENODEV : 0;
A proper if statement would be more readable. There's no need to try to
minimise lines of code.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] wifi: ath9k: fix out-of-bounds endpoint index in htc_issue_send()
2024-10-21 8:47 [PATCH] wifi: ath9k: fix out-of-bounds endpoint index in htc_issue_send() Dmitry Antipov
2024-10-21 8:55 ` Kalle Valo
@ 2024-10-24 13:48 ` Toke Høiland-Jørgensen
1 sibling, 0 replies; 3+ messages in thread
From: Toke Høiland-Jørgensen @ 2024-10-24 13:48 UTC (permalink / raw)
To: Dmitry Antipov
Cc: Kalle Valo, linux-wireless, lvc-project, Dmitry Antipov,
syzbot+93cbd5fbb85814306ba1
Dmitry Antipov <dmantipov@yandex.ru> writes:
> Syzbot has reported the following UBSAN splat:
>
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:35
> index 255 is out of range for type 'struct htc_endpoint[22]'
> ...
> Call Trace:
> ...
> __ubsan_handle_out_of_bounds+0x115/0x140
> htc_send_epid+0x1e0/0x2d0
> ath9k_wmi_cmd+0x31f/0x590
> ath9k_regread+0xdc/0x140
> ? __pfx_ath9k_regread+0x10/0x10
> ? _raw_spin_unlock_irqrestore+0xae/0x110
> ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
> ? __pfx_ath9k_regread+0x10/0x10
> ath9k_hw_init+0x4b0/0x2230
> ? init_timer_key+0x171/0x2d0
> ath9k_htc_probe_device+0xa66/0x1fe0
> ? __pfx_ath9k_htc_probe_device+0x10/0x10
> ? usb_hcd_submit_urb+0x345/0x1ae0
> ? usb_free_urb+0x9d/0x120
> ? ath9k_hif_usb_alloc_urbs+0x1077/0x1150
> ath9k_htc_hw_init+0x32/0x70
> ath9k_hif_usb_firmware_cb+0x240/0x4c0
> ? __pfx_ath9k_hif_usb_firmware_cb+0x10/0x10
> request_firmware_work_func+0x106/0x1c0
> ...
>
> IIUC https://syzkaller.appspot.com/text?tag=ReproC&x=1734b9f1180000 makes
> an attempt to emulate ath9k USB device in somewhat weird and obscure way
> so I'm not sure whether this may happen on a real hardware. OTOH whether
> ending with ENDPOINT_UNUSED in 'htc_connect_service()' may indicate the
> malfunctioned real device, it may be better to reject such a device with
> -ENODEV.
>
> Reported-by: syzbot+93cbd5fbb85814306ba1@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=93cbd5fbb85814306ba1
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
> ---
> drivers/net/wireless/ath/ath9k/htc_hst.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
> index eb631fd3336d..4288ef5b8df5 100644
> --- a/drivers/net/wireless/ath/ath9k/htc_hst.c
> +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
> @@ -295,7 +295,7 @@ int htc_connect_service(struct htc_target *target,
> }
>
> *conn_rsp_epid = target->conn_rsp_epid;
> - return 0;
> + return target->conn_rsp_epid == ENDPOINT_UNUSED ? -ENODEV : 0;
I'll echo Kalle's preference for a proper if statement. But it should
really be an early return above the line that sets *conn_rsp_epid (we
shouldn't touch that on error).
-Toke
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-10-24 13:57 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-21 8:47 [PATCH] wifi: ath9k: fix out-of-bounds endpoint index in htc_issue_send() Dmitry Antipov
2024-10-21 8:55 ` Kalle Valo
2024-10-24 13:48 ` Toke Høiland-Jørgensen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).