lkml.org 
[lkml]   [2020]   [Jun]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.14 02/72] ath9k: Fix use-after-free Write in ath9k_htc_rx_msg
    Date
    From: Qiujun Huang <hqjagain@gmail.com>

    [ Upstream commit e4ff08a4d727146bb6717a39a8d399d834654345 ]

    Write out of slab bounds. We should check epid.

    The case reported by syzbot:
    https://lore.kernel.org/linux-usb/0000000000006ac55b05a1c05d72@google.com
    BUG: KASAN: use-after-free in htc_process_conn_rsp
    drivers/net/wireless/ath/ath9k/htc_hst.c:131 [inline]
    BUG: KASAN: use-after-free in ath9k_htc_rx_msg+0xa25/0xaf0
    drivers/net/wireless/ath/ath9k/htc_hst.c:443
    Write of size 2 at addr ffff8881cea291f0 by task swapper/1/0

    Call Trace:
    htc_process_conn_rsp drivers/net/wireless/ath/ath9k/htc_hst.c:131
    [inline]
    ath9k_htc_rx_msg+0xa25/0xaf0
    drivers/net/wireless/ath/ath9k/htc_hst.c:443
    ath9k_hif_usb_reg_in_cb+0x1ba/0x630
    drivers/net/wireless/ath/ath9k/hif_usb.c:718
    __usb_hcd_giveback_urb+0x29a/0x550 drivers/usb/core/hcd.c:1650
    usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716
    dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966
    call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404
    expire_timers kernel/time/timer.c:1449 [inline]
    __run_timers kernel/time/timer.c:1773 [inline]
    __run_timers kernel/time/timer.c:1740 [inline]
    run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786

    Reported-and-tested-by: syzbot+b1c61e5f11be5782f192@syzkaller.appspotmail.com
    Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20200404041838.10426-4-hqjagain@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
    index 1bf63a4efb4c..d2e062eaf561 100644
    --- a/drivers/net/wireless/ath/ath9k/htc_hst.c
    +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
    @@ -113,6 +113,9 @@ static void htc_process_conn_rsp(struct htc_target *target,

    if (svc_rspmsg->status == HTC_SERVICE_SUCCESS) {
    epid = svc_rspmsg->endpoint_id;
    + if (epid < 0 || epid >= ENDPOINT_MAX)
    + return;
    +
    service_id = be16_to_cpu(svc_rspmsg->service_id);
    max_msglen = be16_to_cpu(svc_rspmsg->max_msg_len);
    endpoint = &target->endpoint[epid];
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-06-09 01:37    [W:4.176 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site