lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 161/772] rtw89: cfo: check mac_id to avoid out-of-bounds
    Date
    From: Ping-Ke Shih <pkshih@realtek.com>

    [ Upstream commit 97df85871a5b187609d30fca6d85b912d9e02f29 ]

    Somehow, hardware reports incorrect mac_id and pollute memory. Check index
    before we access the array.

    UBSAN: array-index-out-of-bounds in rtw89/phy.c:2517:23
    index 188 is out of range for type 's32 [64]'
    CPU: 1 PID: 51550 Comm: irq/35-rtw89_pc Tainted: G OE
    Call Trace:
    <IRQ>
    show_stack+0x52/0x58
    dump_stack_lvl+0x4c/0x63
    dump_stack+0x10/0x12
    ubsan_epilogue+0x9/0x45
    __ubsan_handle_out_of_bounds.cold+0x44/0x49
    ? __alloc_skb+0x92/0x1d0
    rtw89_phy_cfo_parse+0x44/0x7f [rtw89_core]
    rtw89_core_rx+0x261/0x871 [rtw89_core]
    ? __alloc_skb+0xee/0x1d0
    rtw89_pci_napi_poll+0x3fa/0x4ea [rtw89_pci]
    __napi_poll+0x33/0x1a0
    net_rx_action+0x126/0x260
    ? __queue_work+0x217/0x4c0
    __do_softirq+0xd9/0x315
    ? disable_irq_nosync+0x10/0x10
    do_softirq.part.0+0x6d/0x90
    </IRQ>
    <TASK>
    __local_bh_enable_ip+0x62/0x70
    rtw89_pci_interrupt_threadfn+0x182/0x1a6 [rtw89_pci]
    irq_thread_fn+0x28/0x60
    irq_thread+0xc8/0x190
    ? irq_thread_fn+0x60/0x60
    kthread+0x16b/0x190
    ? irq_thread_check_affinity+0xe0/0xe0
    ? set_kthread_struct+0x50/0x50
    ret_from_fork+0x22/0x30
    </TASK>

    Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
    Signed-off-by: Kalle Valo <kvalo@kernel.org>
    Link: https://lore.kernel.org/r/20220516005215.5878-4-pkshih@realtek.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/realtek/rtw89/phy.c | 5 +++++
    1 file changed, 5 insertions(+)

    diff --git a/drivers/net/wireless/realtek/rtw89/phy.c b/drivers/net/wireless/realtek/rtw89/phy.c
    index 147009888de0..777ad4e8f45f 100644
    --- a/drivers/net/wireless/realtek/rtw89/phy.c
    +++ b/drivers/net/wireless/realtek/rtw89/phy.c
    @@ -1872,6 +1872,11 @@ void rtw89_phy_cfo_parse(struct rtw89_dev *rtwdev, s16 cfo_val,
    struct rtw89_cfo_tracking_info *cfo = &rtwdev->cfo_tracking;
    u8 macid = phy_ppdu->mac_id;

    + if (macid >= CFO_TRACK_MAX_USER) {
    + rtw89_warn(rtwdev, "mac_id %d is out of range\n", macid);
    + return;
    + }
    +
    cfo->cfo_tail[macid] += cfo_val;
    cfo->cfo_cnt[macid]++;
    cfo->packet_count++;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-07 22:44    [W:4.822 / U:1.108 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site