No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Jeongjun Park cb480ae80f wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
[ Upstream commit 8619593634cbdf5abf43f5714df49b04e4ef09ab ]

I found the following bug in my fuzzer:

  UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51
  index 255 is out of range for type 'htc_endpoint [22]'
  CPU: 0 UID: 0 PID: 8 Comm: kworker/0:0 Not tainted 6.11.0-rc6-dirty #14
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
  Workqueue: events request_firmware_work_func
  Call Trace:
   <TASK>
   dump_stack_lvl+0x180/0x1b0
   __ubsan_handle_out_of_bounds+0xd4/0x130
   htc_issue_send.constprop.0+0x20c/0x230
   ? _raw_spin_unlock_irqrestore+0x3c/0x70
   ath9k_wmi_cmd+0x41d/0x610
   ? mark_held_locks+0x9f/0xe0
   ...

Since this bug has been confirmed to be caused by insufficient verification
of conn_rsp_epid, I think it would be appropriate to add a range check for
conn_rsp_epid to htc_connect_service() to prevent the bug from occurring.

Fixes: fb9987d0f7 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Jeongjun Park <aha310510@gmail.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://patch.msgid.link/20240909103855.68006-1-aha310510@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-12-14 19:44:25 +01:00
arch ARM: dts: cubieboard4: Fix DCDC5 regulator constraints 2024-12-14 19:44:24 +01:00
block blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race 2024-11-08 16:20:48 +01:00
certs
crypto crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY 2024-12-14 19:44:23 +01:00
Documentation dt-bindings: gpu: Convert Samsung Image Rotator to dt-schema 2024-11-08 16:20:52 +01:00
drivers wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() 2024-12-14 19:44:25 +01:00
fs hfsplus: don't query the device logical block size multiple times 2024-12-14 19:44:22 +01:00
include time: Fix references to _msecs_to_jiffies() handling of values 2024-12-14 19:44:23 +01:00
init initramfs: avoid filename buffer overrun 2024-12-14 19:44:21 +01:00
ipc ipc: replace costly bailout check in sysvipc_find_ipc() 2024-09-04 13:15:02 +02:00
kernel time: Fix references to _msecs_to_jiffies() handling of values 2024-12-14 19:44:23 +01:00
lib debugobjects: Fix conditions in fill_pool() 2024-11-08 16:20:34 +01:00
LICENSES
mm mm: revert "mm: shmem: fix data-race in shmem_getattr()" 2024-12-14 19:44:19 +01:00
net ipmr: Fix access to mfc_cache_list without lock held 2024-12-14 19:44:21 +01:00
samples
scripts kbuild: Use uname for LINUX_COMPILE_HOST detection 2024-12-14 19:44:19 +01:00
security security/keys: fix slab-out-of-bounds in key_task_permission 2024-11-17 14:58:50 +01:00
sound ASoC: stm: Prevent potential division by zero in stm32_sai_get_clk_div() 2024-12-14 19:44:21 +01:00
tools selftests/watchdog-test: Fix system accidentally reset after watchdog-test 2024-12-14 19:44:20 +01:00
usr
virt KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() 2024-11-08 16:20:47 +01:00
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore Remove *.orig pattern from .gitignore 2024-11-08 16:20:33 +01:00
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS
Makefile Linux 5.4.286 2024-11-17 14:58:53 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.