From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Zekun Shen <bruceshenzk@gmail.com>,
Brendan Dolan-Gavitt <brendandg@nyu.edu>,
Kalle Valo <quic_kvalo@quicinc.com>,
Sasha Levin <sashal@kernel.org>,
jirislaby@kernel.org, mickflemm@gmail.com, mcgrof@kernel.org,
kvalo@kernel.org, davem@davemloft.net, kuba@kernel.org,
pabeni@redhat.com, linux-wireless@vger.kernel.org,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 02/65] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
Date: Fri, 1 Apr 2022 10:41:03 -0400 [thread overview]
Message-ID: <20220401144206.1953700-2-sashal@kernel.org> (raw)
In-Reply-To: <20220401144206.1953700-1-sashal@kernel.org>
From: Zekun Shen <bruceshenzk@gmail.com>
[ Upstream commit 564d4eceb97eaf381dd6ef6470b06377bb50c95a ]
The bug was found during fuzzing. Stacktrace locates it in
ath5k_eeprom_convert_pcal_info_5111.
When none of the curve is selected in the loop, idx can go
up to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound.
pd = &chinfo[pier].pd_curves[idx];
There are many OOB writes using pd later in the code. So I
added a sanity check for idx. Checks for other loops involving
AR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not
used outside the loops.
The patch is NOT tested with real device.
The following is the fuzzing report
BUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
Write of size 1 at addr ffff8880174a4d60 by task modprobe/214
CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1
Call Trace:
dump_stack+0x76/0xa0
print_address_description.constprop.0+0x16/0x200
? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
__kasan_report.cold+0x37/0x7c
? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
kasan_report+0xe/0x20
ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
? apic_timer_interrupt+0xa/0x20
? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]
? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k]
ath5k_eeprom_init+0x2513/0x6290 [ath5k]
? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]
? usleep_range+0xb8/0x100
? apic_timer_interrupt+0xa/0x20
? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k]
ath5k_hw_init+0xb60/0x1970 [ath5k]
ath5k_init_ah+0x6fe/0x2530 [ath5k]
? kasprintf+0xa6/0xe0
? ath5k_stop+0x140/0x140 [ath5k]
? _dev_notice+0xf6/0xf6
? apic_timer_interrupt+0xa/0x20
ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k]
? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]
? mutex_lock+0x89/0xd0
? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]
local_pci_probe+0xd3/0x160
pci_device_probe+0x23f/0x3e0
? pci_device_remove+0x280/0x280
? pci_device_remove+0x280/0x280
really_probe+0x209/0x5d0
Reported-by: Brendan Dolan-Gavitt <brendandg@nyu.edu>
Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/YckvDdj3mtCkDRIt@a-10-27-26-18.dynapool.vpn.nyu.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath5k/eeprom.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index 1fbc2c19848f..d444b3d70ba2 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode,
}
}
+ if (idx == AR5K_EEPROM_N_PD_CURVES)
+ goto err_out;
+
ee->ee_pd_gains[mode] = 1;
pd = &chinfo[pier].pd_curves[idx];
--
2.34.1
next parent reply other threads:[~2022-04-01 14:53 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20220401144206.1953700-1-sashal@kernel.org>
2022-04-01 14:41 ` Sasha Levin [this message]
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 07/65] ptp: replace snprintf with sysfs_emit Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 09/65] ath11k: fix kernel panic during unload/load ath11k modules Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 10/65] ath11k: mhi: use mhi_sync_power_up() Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 11/65] bpf: Make dst_port field in struct bpf_sock 16-bit wide Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 15/65] mt76: dma: initialize skip_unmap in mt76_dma_rx_fill Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 16/65] cfg80211: don't add non transmitted BSS to 6GHz scanned channels Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 17/65] libbpf: Fix build issue with llvm-readelf Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 18/65] ipv6: make mc_forwarding atomic Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 25/65] tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 28/65] iwlwifi: mvm: Correctly set fragmented EBS Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 29/65] ipv4: Invalidate neighbour for broadcast address upon address addition Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 38/65] mt76: mt7615: Fix assigning negative values to unsigned variable Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 41/65] net/smc: correct settings of RMB window update limit Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 43/65] macvtap: advertise link netns via netlink Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 44/65] tuntap: add sanity checks about msg_controllen in sendmsg Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 46/65] Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg} Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 47/65] Bluetooth: use memset avoid memory leaks Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 48/65] bnxt_en: Eliminate unintended link toggle during FW reset Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 54/65] can: isotp: set default value for N_As to 50 micro seconds Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 55/65] net: account alternate interface name memory Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 56/65] net: limit altnames to 64k total Sasha Levin
2022-04-01 14:41 ` [PATCH AUTOSEL 5.10 57/65] net: sfp: add 2500base-X quirk for Lantech SFP module Sasha Levin
2022-04-01 14:42 ` [PATCH AUTOSEL 5.10 61/65] Bluetooth: Fix use after free in hci_send_acl Sasha Levin
2022-04-01 14:42 ` [PATCH AUTOSEL 5.10 62/65] netlabel: fix out-of-bounds memory accesses Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220401144206.1953700-2-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=brendandg@nyu.edu \
--cc=bruceshenzk@gmail.com \
--cc=davem@davemloft.net \
--cc=jirislaby@kernel.org \
--cc=kuba@kernel.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=mcgrof@kernel.org \
--cc=mickflemm@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=quic_kvalo@quicinc.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).