Zekun Shen
c4e2f57727
ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 ...
[ Upstream commit 564d4eceb97eaf381dd6ef6470b06377bb50c95a ]
The bug was found during fuzzing. Stacktrace locates it in
ath5k_eeprom_convert_pcal_info_5111.
When none of the curve is selected in the loop, idx can go
up to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound.
pd = &chinfo[pier].pd_curves[idx];
There are many OOB writes using pd later in the code. So I
added a sanity check for idx. Checks for other loops involving
AR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not
used outside the loops.
The patch is NOT tested with real device.
The following is the fuzzing report
BUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
Write of size 1 at addr ffff8880174a4d60 by task modprobe/214
CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1
Call Trace:
dump_stack+0x76/0xa0
print_address_description.constprop.0+0x16/0x200
? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
__kasan_report.cold+0x37/0x7c
? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
kasan_report+0xe/0x20
ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]
? apic_timer_interrupt+0xa/0x20
? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]
? ath5k_pci_eeprom_read+0x228/0x3c0 [ath5k]
ath5k_eeprom_init+0x2513/0x6290 [ath5k]
? ath5k_eeprom_init_11a_pcal_freq+0xbc0/0xbc0 [ath5k]
? usleep_range+0xb8/0x100
? apic_timer_interrupt+0xa/0x20
? ath5k_eeprom_read_pcal_info_2413+0x2f20/0x2f20 [ath5k]
ath5k_hw_init+0xb60/0x1970 [ath5k]
ath5k_init_ah+0x6fe/0x2530 [ath5k]
? kasprintf+0xa6/0xe0
? ath5k_stop+0x140/0x140 [ath5k]
? _dev_notice+0xf6/0xf6
? apic_timer_interrupt+0xa/0x20
ath5k_pci_probe.cold+0x29a/0x3d6 [ath5k]
? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]
? mutex_lock+0x89/0xd0
? ath5k_pci_eeprom_read+0x3c0/0x3c0 [ath5k]
local_pci_probe+0xd3/0x160
pci_device_probe+0x23f/0x3e0
? pci_device_remove+0x280/0x280
? pci_device_remove+0x280/0x280
really_probe+0x209/0x5d0
Reported-by: Brendan Dolan-Gavitt <brendandg@nyu.edu>
Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/YckvDdj3mtCkDRIt@a-10-27-26-18.dynapool.vpn.nyu.edu
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-15 14:18:31 +02:00
ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
2022-04-15 14:18:29 +02:00
binder: fix handling of error during copy
2022-01-27 09:19:38 +01:00
ata: pata_hpt37x: fix PCI clock detection
2022-03-08 19:07:46 +01:00
atm: eni: Add check for dma_map_single
2022-03-23 09:12:07 +01:00
PM: core: keep irq flags in device_pm_check_callbacks()
2022-04-15 14:18:23 +02:00
loop: use sysfs_emit() in the sysfs xxx show()
2022-04-15 14:18:22 +02:00
Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt
2022-04-15 14:18:16 +02:00
hwrng: atmel - disable trng on failure path
2022-04-15 14:18:05 +02:00
clk: Initialize orphan req_rate
2022-04-15 14:18:21 +02:00
clocksource: acpi_pm: fix return value of __setup handler
2022-04-15 14:18:05 +02:00
cpufreq: Fix initialization of min and max frequency QoS requests
2022-01-27 09:19:44 +01:00
crypto: ccp - ccp_dmaengine_unregister release dma channels
2022-04-15 14:18:05 +02:00
dax: make sure inodes are flushed before destroy cache
2022-04-15 14:18:12 +02:00
dmaengine: shdma: Fix runtime PM imbalance on error
2022-03-08 19:07:45 +01:00
udmabuf: validate ubuf->pagecount
2022-04-15 14:18:10 +02:00
EDAC: Fix calculation of returned address and next offset in edac_align_ptr()
2022-02-23 11:59:59 +01:00
firmware: google: Properly state IOMEM dependency
2022-04-15 14:18:20 +02:00
gpio: ts4900: Do not set DAT and OE together
2022-03-16 13:21:46 +01:00
drm: Add orientation quirk for GPD Win Max
2022-04-15 14:18:31 +02:00
greybus: svc: fix an error handling bug in gb_svc_hello()
2022-04-15 14:17:58 +02:00
HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports
2022-04-15 14:18:12 +02:00
HSI: core: Fix return freed object in hsi_new_client
2022-01-27 09:19:41 +01:00
hv_balloon: rate-limit "Unhandled message" warning
2022-04-15 14:18:15 +02:00
hwmon: (pmbus) Add Vin unit off handling
2022-04-15 14:18:05 +02:00
coresight: Fix TRCCONFIGR.QE sysfs interface
2022-04-15 14:17:57 +02:00
i2c: mux: demux-pinctrl: do not deactivate a master that is not active
2022-04-15 14:18:16 +02:00
iio: adc: Add check for devm_request_threaded_irq
2022-04-15 14:18:18 +02:00
RDMA/mlx5: Fix memory leak in error flow for subscribe event routine
2022-04-15 14:18:16 +02:00
Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads"
2022-04-15 14:18:00 +02:00
iommu/ipmmu-vmsa: Check for error num after setting mask
2022-04-15 14:18:12 +02:00
irqchip/nvic: Release nvic_base upon failure
2022-04-15 14:18:22 +02:00
mISDN: change function names to avoid conflicts
2022-01-11 15:23:33 +01:00
mailbox: tegra-hsp: Flush whole channel
2022-04-15 14:18:01 +02:00
dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS
2022-04-15 14:18:13 +02:00
media: hdpvr: initialize dev->worker at hdpvr_register_videodev
2022-04-15 14:18:25 +02:00
memory: emif: check the pointer temp in get_device_details()
2022-04-15 14:18:09 +02:00
mfd: asic3: Add missing iounmap() on error asic3_mfd_probe
2022-04-15 14:18:17 +02:00
kgdbts: fix return value of __setup handler
2022-04-15 14:18:20 +02:00
mmc: host: Return an error when ->enable_sdio_irq() ops is missing
2022-04-15 14:18:25 +02:00
ubi: fastmap: Return error code if memory allocation fails in add_aeb()
2022-04-15 14:18:30 +02:00
ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
2022-04-15 14:18:31 +02:00
nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION
2022-03-28 08:46:43 +02:00
nvme-rdma: fix possible use-after-free in transport error_recovery work
2022-02-23 11:59:56 +01:00
of: base: Improve argument length mismatch error
2022-01-27 09:19:51 +01:00
parisc: Fix sglist access in ccio-dma.c
2022-02-23 11:59:54 +01:00
PCI: Reduce warnings on possible RW1C corruption
2022-04-15 14:18:15 +02:00
pcmcia: fix setting of kthread task states
2022-01-27 09:19:37 +01:00
phy: dphy: Correct lpx parameter and its derivatives(ta_{get,go,sure})
2022-04-15 14:18:18 +02:00
pinctrl: nuvoton: npcm7xx: Use %zu printk format for ARRAY_SIZE()
2022-04-15 14:18:29 +02:00
platform/x86: ISST: Fix possible circular locking dependency detected
2022-02-23 11:59:55 +01:00
power: supply: wm8350-power: Add missing free in free_charger_irq
2022-04-15 14:18:15 +02:00
pwm: lpc18xx-sct: Initialize driver data and hardware before pwmchip_add()
2022-04-15 14:18:17 +02:00
regulator: qcom_smd: fix for_each_child.cocci warnings
2022-04-15 14:18:04 +02:00
remoteproc: qcom_wcnss: Add missing of_node_put() in wcnss_alloc_memory_region
2022-04-15 14:18:19 +02:00
rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev
2022-02-01 17:24:36 +01:00
rtc: wm8350: Handle error for wm8350_register_irq
2022-04-15 14:18:31 +02:00
scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices
2022-02-01 17:24:33 +01:00
scsi: qla2xxx: Use correct feature type field during RFF_ID processing
2022-04-15 14:18:27 +02:00
soc: ti: wkup_m3_ipc: Fix IRQ check in wkup_m3_ipc_probe
2022-04-15 14:18:07 +02:00
spi: tegra20: Use of_device_get_match_data()
2022-04-15 14:18:23 +02:00
staging: mt7621-dts: fix LEDs and pinctrl on GB-PC1 devicetree
2022-04-15 14:18:19 +02:00
scsi: target: iscsi: Make sure the np under each tpg is unique
2022-02-16 12:52:48 +01:00
optee: use driver internal tee_context for some rpc
2022-03-02 11:41:04 +01:00
thermal: int340x: Increase bitmap size
2022-04-15 14:18:02 +02:00
kgdboc: fix return value of __setup handler
2022-04-15 14:18:20 +02:00
USB: storage: ums-realtek: fix error code in rts51x_read_mem()
2022-04-15 14:18:16 +02:00
vhost/vsock: don't check owner in vhost_vsock_stop() while releasing
2022-03-02 11:41:00 +01:00
video: fbdev: sm712fb: Fix crash in smtcfb_write()
2022-04-15 14:18:25 +02:00
virtio: acknowledge all features before access
2022-03-16 13:21:48 +01:00
w1: Misuse of get_user()/put_user() reported by sparse
2022-01-27 09:19:48 +01:00
xen/gnttab: fix gnttab_end_foreign_access() without page specified
2022-03-11 11:22:39 +01:00
c4e2f57727