From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zekun Shen <bruceshenzk@gmail.com>,
Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 105/109] ath9k: fix OOB read ar9300_eeprom_restore_internal
Date: Thu, 9 Sep 2021 07:55:02 -0400 [thread overview]
Message-ID: <20210909115507.147917-105-sashal@kernel.org> (raw)
In-Reply-To: <20210909115507.147917-1-sashal@kernel.org>
From: Zekun Shen <bruceshenzk@gmail.com>
[ Upstream commit 23151b9ae79e3bc4f6a0c4cd3a7f355f68dad128 ]
Bad header can have large length field which can cause OOB.
cptr is the last bytes for read, and the eeprom is parsed
from high to low address. The OOB, triggered by the condition
length > cptr could cause memory error with a read on
negative index.
There are some sanity check around length, but it is not
compared with cptr (the remaining bytes). Here, the
corrupted/bad EEPROM can cause panic.
I was able to reproduce the crash, but I cannot find the
log and the reproducer now. After I applied the patch, the
bug is no longer reproducible.
Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YM3xKsQJ0Hw2hjrc@Zekuns-MBP-16.fios-router.home
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index b4885a700296..b0a4ca3559fd 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3351,7 +3351,8 @@ static int ar9300_eeprom_restore_internal(struct ath_hw *ah,
"Found block at %x: code=%d ref=%d length=%d major=%d minor=%d\n",
cptr, code, reference, length, major, minor);
if ((!AR_SREV_9485(ah) && length >= 1024) ||
- (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485)) {
+ (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485) ||
+ (length > cptr)) {
ath_dbg(common, EEPROM, "Skipping bad header\n");
cptr -= COMP_HDR_LEN;
continue;
--
2.30.2
next prev parent reply other threads:[~2021-09-09 12:59 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20210909115507.147917-1-sashal@kernel.org>
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 006/109] tipc: keep the skb in rcv queue until the whole data is read Sasha Levin
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 008/109] iavf: do not override the adapter state in the watchdog task Sasha Levin
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 009/109] iavf: fix locking of critical sections Sasha Levin
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 012/109] netlink: Deal with ESRCH error in nlmsg_notify() Sasha Levin
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 015/109] igc: Check if num of q_vectors is smaller than max before array access Sasha Levin
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 026/109] bpf/tests: Fix copy-and-paste error in double word test Sasha Levin
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 027/109] bpf/tests: Do not PASS tests without actually testing the result Sasha Levin
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 031/109] ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() Sasha Levin
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 032/109] flow_dissector: Fix out-of-bounds warnings Sasha Levin
2021-09-09 11:53 ` [PATCH AUTOSEL 5.4 040/109] samples: bpf: Fix tracex7 error raised on the missing argument Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 043/109] Bluetooth: skip invalid hci_sync_conn_complete_evt Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 045/109] bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 048/109] bpf: Fix off-by-one in tail call count limiting Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 056/109] net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 058/109] selftests/bpf: Fix xdp_tx.c prog section name Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 059/109] Bluetooth: schedule SCO timeouts with delayed_work Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 060/109] Bluetooth: avoid circular locks in sco_sock_connect Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 061/109] net/mlx5: Fix variable type to match 64bit Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 064/109] mac80211: Fix monitor MTU limit so that A-MSDUs get through Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 070/109] Bluetooth: Fix handling of LE Enhanced Connection Complete Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 073/109] tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 074/109] rpc: fix gss_svc_init cleanup on failure Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 090/109] selftests/bpf: Enlarge select() timeout for test_maps Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 100/109] iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 101/109] iwlwifi: mvm: avoid static queue number aliasing Sasha Levin
2021-09-09 11:54 ` [PATCH AUTOSEL 5.4 102/109] iwlwifi: mvm: fix access to BSS elements Sasha Levin
2021-09-09 11:55 ` [PATCH AUTOSEL 5.4 103/109] net/mlx5: DR, Enable QP retransmission Sasha Levin
2021-09-09 11:55 ` Sasha Levin [this message]
2021-09-09 11:55 ` [PATCH AUTOSEL 5.4 106/109] ath9k: fix sleeping in atomic context Sasha Levin
2021-09-09 11:55 ` [PATCH AUTOSEL 5.4 107/109] net: fix NULL pointer reference in cipso_v4_doi_free Sasha Levin
2021-09-09 11:55 ` [PATCH AUTOSEL 5.4 108/109] fix array-index-out-of-bounds in taprio_change Sasha Levin
2021-09-09 11:55 ` [PATCH AUTOSEL 5.4 109/109] net: w5100: check return value after calling platform_get_resource() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210909115507.147917-105-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=bruceshenzk@gmail.com \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).