lkml.org 
[lkml]   [2020]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 190/757] ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 54f9ab7b870934b70e5a21786d951fbcf663970f ]

    The value for "aid" comes from skb->data so Smatch marks it as
    untrusted. If it's invalid then it can result in an out of bounds array
    access in ath6kl_add_new_sta().

    Fixes: 572e27c00c9d ("ath6kl: Fix AP mode connect event parsing and TIM updates")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20200813141315.GB457408@mwanda
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ath6kl/main.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
    index 5e7ea838a9218..814131a0680a4 100644
    --- a/drivers/net/wireless/ath/ath6kl/main.c
    +++ b/drivers/net/wireless/ath/ath6kl/main.c
    @@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr,

    ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid);

    + if (aid < 1 || aid > AP_MAX_NUM_STA)
    + return;
    +
    if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) {
    struct ieee80211_mgmt *mgmt =
    (struct ieee80211_mgmt *) assoc_info;
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-10-27 16:34    [W:3.024 / U:2.080 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site