From: Kalle Valo <kvalo@kernel.org>
To: Fedor Pchelkin <pchelkin@ispras.ru>
Cc: "Toke Høiland-Jørgensen" <toke@toke.dk>,
"Fedor Pchelkin" <pchelkin@ispras.ru>,
"David S. Miller" <davem@davemloft.net>,
"Eric Dumazet" <edumazet@google.com>,
"Jakub Kicinski" <kuba@kernel.org>,
"Paolo Abeni" <pabeni@redhat.com>,
"Senthil Balasubramanian" <senthilkumar@atheros.com>,
"John W. Linville" <linville@tuxdriver.com>,
"Vasanthakumar Thiagarajan" <vasanth@atheros.com>,
Sujith <Sujith.Manoharan@atheros.com>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org,
"Alexey Khoroshilov" <khoroshilov@ispras.ru>,
lvc-project@linuxtesting.org,
syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com
Subject: Re: [PATCH v2] wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
Date: Fri, 28 Apr 2023 16:52:50 +0000 (UTC) [thread overview]
Message-ID: <168270076830.13772.17120871163314648894.kvalo@kernel.org> (raw)
In-Reply-To: <20230424183348.111355-1-pchelkin@ispras.ru>
Fedor Pchelkin <pchelkin@ispras.ru> wrote:
> For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid
> uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should
> validate pkt_len before accessing the SKB.
>
> For example, the obtained SKB may have been badly constructed with
> pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr
> but after being processed in ath9k_htc_rx_msg() and passed to
> ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI
> command header which should be located inside its data payload.
>
> Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit
> memory can be referenced.
>
> Tested on Qualcomm Atheros Communications AR9271 802.11n .
>
> Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
>
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Reported-and-tested-by: syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com
> Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Patch applied to ath-next branch of ath.git, thanks.
f24292e82708 wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
--
https://patchwork.kernel.org/project/linux-wireless/patch/20230424183348.111355-1-pchelkin@ispras.ru/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
next prev parent reply other threads:[~2023-04-28 16:53 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-15 20:21 [PATCH 0/3] wifi: ath9k: deal with uninit memory Fedor Pchelkin
2023-03-15 20:21 ` [PATCH 1/3] wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx Fedor Pchelkin
2023-03-17 5:26 ` Kalle Valo
2023-03-18 20:25 ` Fedor Pchelkin
2023-04-24 18:23 ` Fedor Pchelkin
2023-04-24 18:33 ` [PATCH v2] " Fedor Pchelkin
2023-04-25 11:14 ` Toke Høiland-Jørgensen
2023-04-28 16:52 ` Kalle Valo [this message]
2023-03-15 20:21 ` [PATCH 2/3] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Fedor Pchelkin
2023-04-24 19:11 ` Fedor Pchelkin
2023-04-24 19:18 ` [PATCH v2] " Fedor Pchelkin
[not found] ` <20230425033832.2041-1-hdanton@sina.com>
2023-04-25 5:45 ` Kalle Valo
2023-04-25 7:54 ` Fedor Pchelkin
2023-04-25 19:26 ` [PATCH v3 1/2] " Fedor Pchelkin
2023-04-25 19:26 ` [PATCH v3 2/2] wifi: ath9k: protect WMI command response buffer replacement with a lock Fedor Pchelkin
2023-08-08 14:07 ` Toke Høiland-Jørgensen
[not found] ` <20230425230708.2132-1-hdanton@sina.com>
2023-04-26 19:02 ` [PATCH v3 1/2] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Fedor Pchelkin
2023-05-15 12:06 ` Toke Høiland-Jørgensen
2023-05-18 10:24 ` Hillf Danton
2023-05-18 15:44 ` Fedor Pchelkin
2023-08-08 14:06 ` Toke Høiland-Jørgensen
2023-08-22 13:35 ` Kalle Valo
2023-03-15 20:21 ` [PATCH 3/3] wifi: ath9k: fix ath9k_wmi_cmd return value when device is unplugged Fedor Pchelkin
2023-03-15 20:47 ` [PATCH 0/3] wifi: ath9k: deal with uninit memory Fedor Pchelkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=168270076830.13772.17120871163314648894.kvalo@kernel.org \
--to=kvalo@kernel.org \
--cc=Sujith.Manoharan@atheros.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=khoroshilov@ispras.ru \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=lvc-project@linuxtesting.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pchelkin@ispras.ru \
--cc=senthilkumar@atheros.com \
--cc=syzbot+f2cb6e0ffdb961921e4d@syzkaller.appspotmail.com \
--cc=toke@toke.dk \
--cc=vasanth@atheros.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.