lkml.org 
[lkml]   [2023]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 6.6 10/31] wifi: ath12k: fix possible out-of-bound write in ath12k_wmi_ext_hal_reg_caps()
    Date
    From: Baochen Qiang <quic_bqiang@quicinc.com>

    [ Upstream commit b302dce3d9edea5b93d1902a541684a967f3c63c ]

    reg_cap.phy_id is extracted from WMI event and could be an unexpected value
    in case some errors happen. As a result out-of-bound write may occur to
    soc->hal_reg_cap. Fix it by validating reg_cap.phy_id before using it.

    This is found during code review.

    Compile tested only.

    Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
    Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
    Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
    Link: https://lore.kernel.org/r/20230830020716.5420-1-quic_bqiang@quicinc.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ath12k/wmi.c | 6 ++++++
    1 file changed, 6 insertions(+)

    diff --git a/drivers/net/wireless/ath/ath12k/wmi.c b/drivers/net/wireless/ath/ath12k/wmi.c
    index ef0f3cf35cfd1..bddf4571d50c1 100644
    --- a/drivers/net/wireless/ath/ath12k/wmi.c
    +++ b/drivers/net/wireless/ath/ath12k/wmi.c
    @@ -3876,6 +3876,12 @@ static int ath12k_wmi_ext_hal_reg_caps(struct ath12k_base *soc,
    ath12k_warn(soc, "failed to extract reg cap %d\n", i);
    return ret;
    }
    +
    + if (reg_cap.phy_id >= MAX_RADIOS) {
    + ath12k_warn(soc, "unexpected phy id %u\n", reg_cap.phy_id);
    + return -EINVAL;
    + }
    +
    soc->hal_reg_cap[reg_cap.phy_id] = reg_cap;
    }
    return 0;
    --
    2.42.0
    \
     
     \ /
      Last update: 2023-11-20 13:51    [W:5.336 / U:0.204 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site