diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-08-13 17:13:15 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-10-29 09:05:34 +0100 |
| commit | f4731aa95dc738a8413bbcb593a3ccc5e727ba01 (patch) | |
| tree | a0378850958ffb18cc49193574ffcd063b435756 | |
| parent | ddfa08163fade653d9c5fafc72f7f45c0d65d7c5 (diff) | |
| download | linux-stable-f4731aa95dc738a8413bbcb593a3ccc5e727ba01.tar.gz linux-stable-f4731aa95dc738a8413bbcb593a3ccc5e727ba01.tar.bz2 linux-stable-f4731aa95dc738a8413bbcb593a3ccc5e727ba01.zip | |
ath6kl: prevent potential array overflow in ath6kl_add_new_sta()
[ Upstream commit 54f9ab7b870934b70e5a21786d951fbcf663970f ]
The value for "aid" comes from skb->data so Smatch marks it as
untrusted. If it's invalid then it can result in an out of bounds array
access in ath6kl_add_new_sta().
Fixes: 572e27c00c9d ("ath6kl: Fix AP mode connect event parsing and TIM updates")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200813141315.GB457408@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/main.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c index 1af3fed5a72c..1a6851827968 100644 --- a/drivers/net/wireless/ath/ath6kl/main.c +++ b/drivers/net/wireless/ath/ath6kl/main.c @@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr, ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid); + if (aid < 1 || aid > AP_MAX_NUM_STA) + return; + if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) { struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) assoc_info; |