Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/drivers/net/wireless/ath/ath9k
History
Minsuk Kang 595302a9f7 wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() 
[ Upstream commit 2adc886244dff60f948497b59affb6c6ebb3c348 ]

Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug
occurs when txs->cnt, data from a URB provided by a USB device, is
bigger than the size of the array txs->txstatus, which is
HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug
handling code after the check. Make the function return if that is the
case.

Found by a modified version of syzkaller.

UBSAN: array-index-out-of-bounds in htc_drv_txrx.c
index 13 is out of range for type '__wmi_event_txstatus [12]'
Call Trace:
 ath9k_htc_txstatus
 ath9k_wmi_event_tasklet
 tasklet_action_common
 __do_softirq
 irq_exit_rxu
 sysvec_apic_timer_interrupt

Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20231113065756.1491991-1-linuxlovemin@yonsei.ac.kr
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 12:13:12 +01:00
..
ahb.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ani.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ani.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
antenna.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar953x_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar955x_1p0_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar956x_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar5008_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar5008_phy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9001_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9002_calib.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9002_hw.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9002_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9002_mac.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9002_phy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9002_phy.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_2p2_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_aic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_aic.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_buffalo_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_calib.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_eeprom.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_eeprom.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_hw.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_mac.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_mac.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_mci.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_mci.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_paprd.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_phy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_phy.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_rtt.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_rtt.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9003_wow.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9330_1p1_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9330_1p2_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9340_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9462_2p0_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9462_2p1_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9485_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9565_1p0_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9565_1p1_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ar9580_1p0_initvals.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ath9k.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ath9k_pci_owl_loader.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
beacon.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
btcoex.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
btcoex.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
calib.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
calib.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
channel.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common-beacon.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common-beacon.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common-debug.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common-debug.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common-init.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common-init.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common-spectral.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common-spectral.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
common.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debug.c wifi: ath9k: fix clang-specific fortify warnings 2024-11-18 11:43:12 +01:00
debug.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debug_sta.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dfs.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dfs_debug.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dfs_debug.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dynack.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dynack.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eeprom.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eeprom.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eeprom_4k.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eeprom_9287.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eeprom_def.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gpio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hif_usb.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hif_usb.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
htc.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
htc_drv_beacon.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
htc_drv_debug.c wifi: ath9k: fix clang-specific fortify warnings 2024-11-18 11:43:12 +01:00
htc_drv_gpio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
htc_drv_init.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
htc_drv_main.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
htc_drv_txrx.c wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() 2024-11-18 12:13:12 +01:00
htc_hst.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
htc_hst.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hw-ops.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hw.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hw.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
init.c Backport mac80211 patches from linux-6.1.y 2024-06-15 16:29:20 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
link.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mac.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mac.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
main.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mci.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mci.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pci.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
phy.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
recv.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reg.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reg_aic.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reg_mci.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reg_wow.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rng.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tx99.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wmi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wmi.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wow.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xmit.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00