diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2022-04-09 09:12:25 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-06-14 18:11:33 +0200 |
| commit | 2326d398ccd41ba6d93b8346532dfa432ab00fee (patch) | |
| tree | 1cabab164d970779df90dcf7f17d8e10716ebdea | |
| parent | cd1f386120d0a43c4195e7f1a1c3e48c73208e34 (diff) | |
| download | linux-stable-2326d398ccd41ba6d93b8346532dfa432ab00fee.tar.gz linux-stable-2326d398ccd41ba6d93b8346532dfa432ab00fee.tar.bz2 linux-stable-2326d398ccd41ba6d93b8346532dfa432ab00fee.zip | |
ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
[ Upstream commit 2dc509305cf956381532792cb8dceef2b1504765 ]
The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to
ensure that it is within the bitmap.
drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept()
error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()'
Fixes: 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220409061225.GA5447@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c index 628f45c8c06f..eeaf63de71bf 100644 --- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c +++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c @@ -1005,6 +1005,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv, goto rx_next; } + if (rxstatus->rs_keyix >= ATH_KEYMAX && + rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) { + ath_dbg(common, ANY, + "Invalid keyix, dropping (keyix: %d)\n", + rxstatus->rs_keyix); + goto rx_next; + } + /* Get the RX status information */ memset(rx_status, 0, sizeof(struct ieee80211_rx_status)); |