UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix 

The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to
ensure that it is within the bitmap.

drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept()
error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()'

Fixes: 4ed1a8d4a2 ("ath9k_htc: use ath9k_cmn_rx_accept")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220409061225.GA5447@kili
This commit is contained in:
Dan Carpenter 2022-04-09 09:12:25 +03:00 committed by Kalle Valo
parent 45286070e9
commit 2dc509305c
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
View File

@ -1016,6 +1016,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
goto rx_next;
}
if (rxstatus->rs_keyix >= ATH_KEYMAX &&
rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) {
ath_dbg(common, ANY,
"Invalid keyix, dropping (keyix: %d)\n",
rxstatus->rs_keyix);
goto rx_next;
}
/* Get the RX status information */
memset(rx_status, 0, sizeof(struct ieee80211_rx_status));