linux-kernel - [PATCH] wireless: ath6kl: fix out of bound from length.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Jul 2022 11:21:58 +0800
From:   xiaolinkui <xiaolinkui@...il.com>
To:     kvalo@...nel.org, davem@...emloft.net, edumazet@...gle.com,
        kuba@...nel.org, pabeni@...hat.com, gustavoars@...nel.org,
        quic_jjohnson@...cinc.com, keescook@...omium.org, johan@...nel.org,
        dan.carpenter@...cle.com, xiaolinkui@...il.com
Cc:     linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, Linkui Xiao <xiaolinkui@...inos.cn>
Subject: [PATCH] wireless: ath6kl: fix out of bound from length.

From: Linkui Xiao <xiaolinkui@...inos.cn>

If length from debug_buf.length is 4294967293 (0xfffffffd), the result of
ALIGN(size, 4) will be 0.

	length = ALIGN(length, 4);

In case of length == 4294967293 after four-byte aligned access, length will
become 0.

	ret = ath6kl_diag_read(ar, address, buf, length);

will fail to read.

Fixes: bc07ddb29a7b ("ath6kl: read fwlog from firmware ring buffer")
Signed-off-by: Linkui Xiao <xiaolinkui@...inos.cn>
---
 drivers/net/wireless/ath/ath6kl/core.h | 2 +-
 drivers/net/wireless/ath/ath6kl/main.c | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 77e052336eb5..b90ad9541e09 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -907,7 +907,7 @@ void ath6kl_cleanup_amsdu_rxbufs(struct ath6kl *ar);
 int ath6kl_diag_write32(struct ath6kl *ar, u32 address, __le32 value);
 int ath6kl_diag_write(struct ath6kl *ar, u32 address, void *data, u32 length);
 int ath6kl_diag_read32(struct ath6kl *ar, u32 address, u32 *value);
-int ath6kl_diag_read(struct ath6kl *ar, u32 address, void *data, u32 length);
+int ath6kl_diag_read(struct ath6kl *ar, u32 address, void *data, size_t length);
 int ath6kl_read_fwlogs(struct ath6kl *ar);
 void ath6kl_init_profile_info(struct ath6kl_vif *vif);
 void ath6kl_tx_data_cleanup(struct ath6kl *ar);
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index d3aa9e7a37c2..e9e66d5ad505 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -233,7 +233,7 @@ int ath6kl_diag_write32(struct ath6kl *ar, u32 address, __le32 value)
 	return 0;
 }
 
-int ath6kl_diag_read(struct ath6kl *ar, u32 address, void *data, u32 length)
+int ath6kl_diag_read(struct ath6kl *ar, u32 address, void *data, size_t length)
 {
 	u32 count, *buf = data;
 	int ret;
@@ -272,7 +272,8 @@ int ath6kl_read_fwlogs(struct ath6kl *ar)
 {
 	struct ath6kl_dbglog_hdr debug_hdr;
 	struct ath6kl_dbglog_buf debug_buf;
-	u32 address, length, firstbuf, debug_hdr_addr;
+	u32 address, firstbuf, debug_hdr_addr;
+	size_t length;
 	int ret, loop;
 	u8 *buf;
 
-- 
2.17.1