From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Ping-Ke Shih <pkshih@realtek.com>,
Dan Carpenter <dan.carpenter@oracle.com>,
Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>,
kvalo@kernel.org, davem@davemloft.net, kuba@kernel.org,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.16 074/217] rtw89: fix potentially access out of range of RF register array
Date: Mon, 17 Jan 2022 21:17:17 -0500 [thread overview]
Message-ID: <20220118021940.1942199-74-sashal@kernel.org> (raw)
In-Reply-To: <20220118021940.1942199-1-sashal@kernel.org>
From: Ping-Ke Shih <pkshih@realtek.com>
[ Upstream commit 30101812a09b37bc8aa409a83f603d4c072198f2 ]
The RF register array is used to help firmware to restore RF settings.
The original code can potentially access out of range, if the size is
between (RTW89_H2C_RF_PAGE_SIZE * RTW89_H2C_RF_PAGE_NUM + 1) to
((RTW89_H2C_RF_PAGE_SIZE + 1) * RTW89_H2C_RF_PAGE_NUM). Fortunately,
current used size doesn't fall into the wrong case, and the size will not
change if we don't update RF parameter.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211119055729.12826-1-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw89/phy.c | 33 ++++++++++++++----------
1 file changed, 19 insertions(+), 14 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c
index ab134856baac7..d75e9de8df7c6 100644
--- a/drivers/net/wireless/realtek/rtw89/phy.c
+++ b/drivers/net/wireless/realtek/rtw89/phy.c
@@ -654,6 +654,12 @@ rtw89_phy_cofig_rf_reg_store(struct rtw89_dev *rtwdev,
u16 idx = info->curr_idx % RTW89_H2C_RF_PAGE_SIZE;
u8 page = info->curr_idx / RTW89_H2C_RF_PAGE_SIZE;
+ if (page >= RTW89_H2C_RF_PAGE_NUM) {
+ rtw89_warn(rtwdev, "RF parameters exceed size. path=%d, idx=%d",
+ rf_path, info->curr_idx);
+ return;
+ }
+
info->rtw89_phy_config_rf_h2c[page][idx] =
cpu_to_le32((reg->addr << 20) | reg->data);
info->curr_idx++;
@@ -662,30 +668,29 @@ rtw89_phy_cofig_rf_reg_store(struct rtw89_dev *rtwdev,
static int rtw89_phy_config_rf_reg_fw(struct rtw89_dev *rtwdev,
struct rtw89_fw_h2c_rf_reg_info *info)
{
- u16 page = info->curr_idx / RTW89_H2C_RF_PAGE_SIZE;
- u16 len = (info->curr_idx % RTW89_H2C_RF_PAGE_SIZE) * 4;
+ u16 remain = info->curr_idx;
+ u16 len = 0;
u8 i;
int ret = 0;
- if (page > RTW89_H2C_RF_PAGE_NUM) {
+ if (remain > RTW89_H2C_RF_PAGE_NUM * RTW89_H2C_RF_PAGE_SIZE) {
rtw89_warn(rtwdev,
- "rf reg h2c total page num %d larger than %d (RTW89_H2C_RF_PAGE_NUM)\n",
- page, RTW89_H2C_RF_PAGE_NUM);
- return -EINVAL;
+ "rf reg h2c total len %d larger than %d\n",
+ remain, RTW89_H2C_RF_PAGE_NUM * RTW89_H2C_RF_PAGE_SIZE);
+ ret = -EINVAL;
+ goto out;
}
- for (i = 0; i < page; i++) {
- ret = rtw89_fw_h2c_rf_reg(rtwdev, info,
- RTW89_H2C_RF_PAGE_SIZE * 4, i);
+ for (i = 0; i < RTW89_H2C_RF_PAGE_NUM && remain; i++, remain -= len) {
+ len = remain > RTW89_H2C_RF_PAGE_SIZE ? RTW89_H2C_RF_PAGE_SIZE : remain;
+ ret = rtw89_fw_h2c_rf_reg(rtwdev, info, len * 4, i);
if (ret)
- return ret;
+ goto out;
}
- ret = rtw89_fw_h2c_rf_reg(rtwdev, info, len, i);
- if (ret)
- return ret;
+out:
info->curr_idx = 0;
- return 0;
+ return ret;
}
static void rtw89_phy_config_rf_reg(struct rtw89_dev *rtwdev,
--
2.34.1
next prev parent reply other threads:[~2022-01-18 2:25 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20220118021940.1942199-1-sashal@kernel.org>
2022-01-18 2:16 ` [PATCH AUTOSEL 5.16 015/217] ar5523: Fix null-ptr-deref with unexpected WDCMSG_TARGET_START reply Sasha Levin
2022-01-18 2:16 ` [PATCH AUTOSEL 5.16 024/217] ath11k: enable IEEE80211_VHT_EXT_NSS_BW_CAPABLE if NSS ratio enabled Sasha Levin
2022-01-18 2:16 ` [PATCH AUTOSEL 5.16 028/217] ath11k: Fix crash caused by uninitialized TX ring Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 059/217] ath11k: Fix mon status ring rx tlv processing Sasha Levin
2022-01-18 2:17 ` Sasha Levin [this message]
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 075/217] rtw88: add quirk to disable pci caps on HP 250 G7 Notebook PC Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 076/217] mwifiex: Fix skb_over_panic in mwifiex_usb_recv() Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 077/217] rsi: Fix use-after-free in rsi_rx_done_handler() Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 078/217] rsi: Fix out-of-bounds read in rsi_read_pkt() Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 079/217] ath11k: Avoid NULL ptr access during mgmt tx cleanup Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 104/217] iwlwifi: mvm: synchronize with FW after multicast commands Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 105/217] iwlwifi: mvm: avoid clearing a just saved session protection id Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 106/217] iwlwifi: acpi: fix wgds rev 3 size Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 109/217] ath11k: avoid deadlock by change ieee80211_queue_work for regd_update_work Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 110/217] ath10k: Fix tx hanging Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 111/217] rtw89: don't kick off TX DMA if failed to write skb Sasha Levin
2022-01-18 2:17 ` [PATCH AUTOSEL 5.16 113/217] ath10k: drop beacon and probe response which leak from other channel Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 120/217] ath11k: Avoid false DEADLOCK warning reported by lockdep Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 152/217] mt76: mt7615: fix possible deadlock while mt7615_register_ext_phy() Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 153/217] mt76: mt7915: fix SMPS operation fail Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 154/217] mt76: connac: fix a theoretical NULL pointer dereference in mt76_connac_get_phy_mode Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 155/217] mt76: do not pass the received frame with decryption error Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 156/217] mt76: mt7615: improve wmm index allocation Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 157/217] mt76: mt7921: fix network buffer leak by txs missing Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 158/217] ath9k_htc: fix NULL pointer dereference at ath9k_htc_rxep() Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 159/217] ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet() Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 160/217] ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 161/217] rtw88: 8822c: update rx settings to prevent potential hw deadlock Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 163/217] iwlwifi: recognize missing PNVM data and then log filename Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 164/217] iwlwifi: fix leaks/bad data after failed firmware load Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 165/217] iwlwifi: remove module loading failure message Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 166/217] iwlwifi: mvm: Fix calculation of frame length Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 167/217] iwlwifi: mvm: fix AUX ROC removal Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 168/217] iwlwifi: pcie: make sure prph_info is set when treating wakeup IRQ Sasha Levin
2022-01-18 2:18 ` [PATCH AUTOSEL 5.16 172/217] ath11k: Fix napi related hang Sasha Levin
2022-01-18 2:19 ` [PATCH AUTOSEL 5.16 195/217] mac80211: allow non-standard VHT MCS-10/11 Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220118021940.1942199-74-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=kvalo@codeaurora.org \
--cc=kvalo@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pkshih@realtek.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).