Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/drivers/net
History
Minsuk Kang 595302a9f7 wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() 
[ Upstream commit 2adc886244dff60f948497b59affb6c6ebb3c348 ]

Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug
occurs when txs->cnt, data from a URB provided by a USB device, is
bigger than the size of the array txs->txstatus, which is
HTC_MAX_TX_STATUS. WARN_ON() already checks it, but there is no bug
handling code after the check. Make the function return if that is the
case.

Found by a modified version of syzkaller.

UBSAN: array-index-out-of-bounds in htc_drv_txrx.c
index 13 is out of range for type '__wmi_event_txstatus [12]'
Call Trace:
 ath9k_htc_txstatus
 ath9k_wmi_event_tasklet
 tasklet_action_common
 __do_softirq
 irq_exit_rxu
 sysvec_apic_timer_interrupt

Signed-off-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20231113065756.1491991-1-linuxlovemin@yonsei.ac.kr
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 12:13:12 +01:00
..
appletalk Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
arcnet arcnet: restoring support for multiple Sohard Arcnet cards 2024-11-18 12:11:39 +01:00
bonding bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk 2024-11-18 12:13:12 +01:00
caif Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
can can: dev: can_restart(): fix race condition between controller restart and netif_carrier_on() 2024-11-18 11:42:49 +01:00
dropdump Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dsa net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe 2024-11-18 12:12:51 +01:00
ethernet net: fec: fix the unhandled context fault from smmu 2024-11-18 12:13:01 +01:00
fddi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fjes fjes: fix memleaks in fjes_hw_setup 2024-11-18 12:13:01 +01:00
hamradio Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hippi Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hyperv hv_netvsc: rndis_filter needs to select NLS 2024-11-18 12:11:39 +01:00
ieee802154 net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show() 2024-11-18 10:58:29 +01:00
ipa Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ipvlan ipvlan: add ipvlan_route_v6_outbound() helper 2024-11-18 11:43:19 +01:00
mdio Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netdevsim Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pcs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
phy net: phy: micrel: populate .soft_reset for KSZ9131 2024-11-18 12:12:51 +01:00
plip Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ppp ppp: limit MRU to 64K 2024-11-18 11:43:19 +01:00
slip Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
team team: Fix use-after-free when an option instance allocation fails 2024-11-18 12:11:57 +01:00
usb asix: Add check for usbnet_get_endpoints 2024-11-18 12:12:07 +01:00
vmxnet3 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vxlan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wimax Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
wireguard wireguard: use DEV_STATS_INC() 2024-11-18 12:10:54 +01:00
wireless wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() 2024-11-18 12:13:12 +01:00
xen-netback xen-netback: don't produce zero-size SKB frags 2024-11-18 12:12:45 +01:00
bareudp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dummy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
eql.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
geneve.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gtp.c gtp: fix fragmentation needed check with gso 2024-11-18 10:58:30 +01:00
ifb.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
LICENSE.SRC Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
loopback.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
macsec.c net: macsec: indicate next pn update when offloading 2024-11-08 11:25:46 +01:00
macvlan.c macvlan: Don't propagate promisc change to lower dev in passthru 2024-11-18 11:43:20 +01:00
macvtap.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mdio.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mii.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
net_failover.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
netconsole.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nlmon.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ntb_netdev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rionet.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sb1000.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Space.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sungem_phy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tap.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
thunderbolt.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tun.c tun: prevent negative ifindex 2024-11-08 11:26:10 +01:00
veth.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
virtio_net.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vrf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vsockmon.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xen-netfront.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00