netdev - Re: [PATCH v4] wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <167102084873.7997.7208445829168605177.kvalo@kernel.org>
Date:   Wed, 14 Dec 2022 12:27:30 +0000 (UTC)
From:   Kalle Valo <kvalo@...nel.org>
To:     Li Zetao <lizetao1@...wei.com>
Cc:     <pkshih@...ltek.com>, <Larry.Finger@...inger.net>,
        <davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
        <linux-kernel@...r.kernel.org>, <linux-wireless@...r.kernel.org>,
        <linville@...driver.com>, <lizetao1@...wei.com>,
        <netdev@...r.kernel.org>, <pabeni@...hat.com>
Subject: Re: [PATCH v4] wifi: rtlwifi: Fix global-out-of-bounds bug in
 _rtl8812ae_phy_set_txpower_limit()

Li Zetao <lizetao1@...wei.com> wrote:

> There is a global-out-of-bounds reported by KASAN:
> 
>   BUG: KASAN: global-out-of-bounds in
>   _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
>   Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411
> 
>   CPU: 6 PID: 411 Comm: NetworkManager Tainted: G      D
>   6.1.0-rc8+ #144 e15588508517267d37
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
>   Call Trace:
>    <TASK>
>    ...
>    kasan_report+0xbb/0x1c0
>    _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
>    rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]
>    rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]
>    ...
>    </TASK>
> 
> The root cause of the problem is that the comparison order of
> "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The
> _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two
> strings from tail to head, which causes the problem. In the
> _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet
> this requirement by carefully designing the comparison order.
> For example, "pregulation" and "pbandwidth" are compared in order of
> length from small to large, first is 3 and last is 4. However, the
> comparison order of "prate_section" dose not obey such order requirement,
> therefore when "prate_section" is "HT", when comparing from tail to head,
> it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As
> mentioned above, the _rtl8812ae_eq_n_byte() has the same function as
> strcmp(), so just strcmp() is enough.
> 
> Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.
> Although it can be fixed by adjusting the comparison order of
> "prate_section", this may cause the value of "rate_section" to not be
> from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver
> from staging to regular tree, but also added setting txpower limit
> function during the driver config phase, so the problem was introduced
> by this commit.
> 
> Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree")
> Signed-off-by: Li Zetao <lizetao1@...wei.com>
> Acked-by: Ping-Ke Shih <pkshih@...ltek.com>

Patch applied to wireless-next.git, thanks.

117dbeda22ec wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20221212025812.1541311-1-lizetao1@huawei.com/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches