From: Qiujun Huang <hqjagain@gmail.com> To: kvalo@codeaurora.org, ath9k-devel@qca.qualcomm.com Cc: davem@davemloft.net, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, anenbupt@gmail.com, syzkaller-bugs@googlegroups.com, Qiujun Huang <hqjagain@gmail.com> Subject: [PATCH 3/5] ath9k: Fix use-after-free Write in ath9k_htc_rx_msg Date: Sat, 4 Apr 2020 12:18:36 +0800 [thread overview] Message-ID: <20200404041838.10426-4-hqjagain@gmail.com> (raw) In-Reply-To: <20200404041838.10426-1-hqjagain@gmail.com> Write out of slab bounds. We should check epid. The case reported by syzbot: https://lore.kernel.org/linux-usb/0000000000006ac55b05a1c05d72@google.com BUG: KASAN: use-after-free in htc_process_conn_rsp drivers/net/wireless/ath/ath9k/htc_hst.c:131 [inline] BUG: KASAN: use-after-free in ath9k_htc_rx_msg+0xa25/0xaf0 drivers/net/wireless/ath/ath9k/htc_hst.c:443 Write of size 2 at addr ffff8881cea291f0 by task swapper/1/0 Call Trace: htc_process_conn_rsp drivers/net/wireless/ath/ath9k/htc_hst.c:131 [inline] ath9k_htc_rx_msg+0xa25/0xaf0 drivers/net/wireless/ath/ath9k/htc_hst.c:443 ath9k_hif_usb_reg_in_cb+0x1ba/0x630 drivers/net/wireless/ath/ath9k/hif_usb.c:718 __usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716 dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966 call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786 Reported-and-tested-by: syzbot+b1c61e5f11be5782f192@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain@gmail.com> --- drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c index 1bf63a4efb4c..d2e062eaf561 100644 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -113,6 +113,9 @@ static void htc_process_conn_rsp(struct htc_target *target, if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) { epid = svc_rspmsg->endpoint_id; + if (epid < 0 || epid >= ENDPOINT_MAX) + return; + service_id = be16_to_cpu(svc_rspmsg->service_id); max_msglen = be16_to_cpu(svc_rspmsg->max_msg_len); endpoint = &target->endpoint[epid]; -- 2.17.1
next prev parent reply other threads:[~2020-04-04 4:19 UTC|newest] Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-04-04 4:18 [PATCH 0/5] ath9k: bug fixes Qiujun Huang 2020-04-04 4:18 ` [PATCH 1/5] ath9k: Fix use-after-free Read in htc_connect_service Qiujun Huang 2020-04-07 5:01 ` Kalle Valo 2020-04-07 10:51 ` Dan Carpenter 2020-04-04 4:18 ` [PATCH 2/5] ath9k: Fix use-after-free Read in ath9k_wmi_ctrl_rx Qiujun Huang 2020-04-04 4:18 ` Qiujun Huang [this message] 2020-04-04 4:18 ` [PATCH 4/5 resend] ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb Qiujun Huang 2020-04-04 4:18 ` [PATCH 5/5] ath9k: Fix general protection fault " Qiujun Huang 2020-04-07 12:50 ` Dan Carpenter 2020-06-20 21:04 ` [BISECTED REGRESSION] " Roman Mamedov 2020-06-22 14:36 ` Kalle Valo 2020-07-01 15:53 ` [PATCH] Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb" Viktor Jägersküpper 2020-07-01 19:56 ` Roman Mamedov 2020-07-01 21:32 ` [PATCH v2] " Viktor Jägersküpper 2020-07-02 6:43 ` [PATCH] " Kalle Valo 2020-07-09 14:36 ` Viktor Jägersküpper 2020-07-13 14:26 ` Kalle Valo
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200404041838.10426-4-hqjagain@gmail.com \ --to=hqjagain@gmail.com \ --cc=anenbupt@gmail.com \ --cc=ath9k-devel@qca.qualcomm.com \ --cc=davem@davemloft.net \ --cc=kvalo@codeaurora.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-wireless@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=syzkaller-bugs@googlegroups.com \ --subject='Re: [PATCH 3/5] ath9k: Fix use-after-free Write in ath9k_htc_rx_msg' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).