No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Fedor Pchelkin cd83167670 wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
[ Upstream commit 0af54343a76263a12dbae7fafb64eb47c4a6ad38 ]

Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream().
While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated
skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we
have an incorrect pkt_len or pkt_tag, the input skb is considered invalid
and dropped. All the associated packets already in skb_pool should be
dropped and freed. Added a comment describing this issue.

The patch also makes remain_skb NULL after being processed so that it
cannot be referenced after potential free. The initialization of hif_dev
fields which are associated with remain_skb (rx_remain_len,
rx_transfer_len and rx_pad_len) is moved after a new remain_skb is
allocated.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: 6ce708f54cc8 ("ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream")
Fixes: 44b23b488d ("ath9k: hif_usb: Reduce indent 1 column")
Reported-by: syzbot+e9632e3eb038d93d6bc6@syzkaller.appspotmail.com
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230104123615.51511-1-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-03-11 16:43:39 +01:00
arch crypto: x86/ghash - fix unaligned access in ghash_setkey() 2023-03-11 16:43:38 +01:00
block block: bio-integrity: Copy flags when bio_integrity_payload is cloned 2023-03-11 16:43:35 +01:00
certs
crypto
Documentation docs: Fix path paste-o for /sys/kernel/warn_count 2023-02-06 07:52:50 +01:00
drivers wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails 2023-03-11 16:43:39 +01:00
fs btrfs: send: limit number of clones and allocated memory size 2023-03-03 11:41:48 +01:00
include genirq: Fix the return type of kstat_cpu_irqs_sum() 2023-03-11 16:43:38 +01:00
init
ipc
kernel sched/rt: pick_next_rt_entity(): check list_entry 2023-03-11 16:43:35 +01:00
lib lib/mpi: Fix buffer overrun when SG is too long 2023-03-11 16:43:38 +01:00
LICENSES
mm Revert "mm: Always release pages to the buddy allocator in memblock_free_late()." 2023-02-22 12:50:39 +01:00
net net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from sk_stream_kill_queues(). 2023-03-03 11:41:48 +01:00
samples
scripts
security
sound ASoC: SOF: Intel: hda-dai: fix possible stream_tag leak 2023-02-22 12:50:42 +01:00
tools Revert "ipv4: Fix incorrect route flushing when source address is deleted" 2023-02-22 12:50:38 +01:00
usr
virt
.clang-format
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore
.mailmap
COPYING
CREDITS
Kbuild
Kconfig
MAINTAINERS net/phy/mdio-i2c: Move header file to include/linux/mdio 2023-02-06 07:52:46 +01:00
Makefile Linux 5.4.234 2023-03-03 11:41:49 +01:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.