From: Zekun Shen <bruceshenzk@gmail.com> To: unlisted-recipients:; (no To-header on input) Cc: Zekun Shen <bruceshenzk@gmail.com>, Kalle Valo <kvalo@codeaurora.org>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org>, ath10k@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] net: ath10k: santity check for ep connectivity Date: Sun, 21 Jun 2020 22:20:54 -0400 [thread overview] Message-ID: <20200622022055.16028-1-bruceshenzk@gmail.com> (raw) Function ep_rx_complete is being called without NULL checking in ath10k_htc_rx_completion_handler. Without such check, mal- formed packet is able to cause jump to NULL. ep->service_id seems a good candidate for sanity check as it is used in usb.c. Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> --- drivers/net/wireless/ath/ath10k/htc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c index 31df6dd04..e00794d97 100644 --- a/drivers/net/wireless/ath/ath10k/htc.c +++ b/drivers/net/wireless/ath/ath10k/htc.c @@ -450,6 +450,11 @@ void ath10k_htc_rx_completion_handler(struct ath10k *ar, struct sk_buff *skb) ep = &htc->endpoint[eid]; + if (ep->service_id == 0) { + ath10k_warn(ar, "HTC Rx: ep %d is not connect\n", eid); + goto out; + } + payload_len = __le16_to_cpu(hdr->len); if (payload_len + sizeof(*hdr) > ATH10K_HTC_MAX_LEN) { -- 2.17.1
WARNING: multiple messages have this Message-ID (diff)
From: Zekun Shen <bruceshenzk@gmail.com> Cc: netdev@vger.kernel.org, linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, ath10k@lists.infradead.org, Zekun Shen <bruceshenzk@gmail.com>, Jakub Kicinski <kuba@kernel.org>, "David S. Miller" <davem@davemloft.net>, Kalle Valo <kvalo@codeaurora.org> Subject: [PATCH] net: ath10k: santity check for ep connectivity Date: Sun, 21 Jun 2020 22:20:54 -0400 [thread overview] Message-ID: <20200622022055.16028-1-bruceshenzk@gmail.com> (raw) Function ep_rx_complete is being called without NULL checking in ath10k_htc_rx_completion_handler. Without such check, mal- formed packet is able to cause jump to NULL. ep->service_id seems a good candidate for sanity check as it is used in usb.c. Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> --- drivers/net/wireless/ath/ath10k/htc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c index 31df6dd04..e00794d97 100644 --- a/drivers/net/wireless/ath/ath10k/htc.c +++ b/drivers/net/wireless/ath/ath10k/htc.c @@ -450,6 +450,11 @@ void ath10k_htc_rx_completion_handler(struct ath10k *ar, struct sk_buff *skb) ep = &htc->endpoint[eid]; + if (ep->service_id == 0) { + ath10k_warn(ar, "HTC Rx: ep %d is not connect\n", eid); + goto out; + } + payload_len = __le16_to_cpu(hdr->len); if (payload_len + sizeof(*hdr) > ATH10K_HTC_MAX_LEN) { -- 2.17.1 _______________________________________________ ath10k mailing list ath10k@lists.infradead.org http://lists.infradead.org/mailman/listinfo/ath10k
next reply other threads:[~2020-06-22 2:21 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-06-22 2:20 Zekun Shen [this message] 2020-06-22 2:20 ` [PATCH] net: ath10k: santity check for ep connectivity Zekun Shen 2020-12-21 18:15 ` Kalle Valo 2020-12-21 18:15 ` Kalle Valo 2021-01-18 16:12 ` Kalle Valo 2021-01-18 16:12 ` Kalle Valo
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200622022055.16028-1-bruceshenzk@gmail.com \ --to=bruceshenzk@gmail.com \ --cc=ath10k@lists.infradead.org \ --cc=davem@davemloft.net \ --cc=kuba@kernel.org \ --cc=kvalo@codeaurora.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-wireless@vger.kernel.org \ --cc=netdev@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.