lkml.org 
[lkml]   [2019]   [Jul]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.2 012/249] ath10k: add peer id check in ath10k_peer_find_by_id
    Date
    From: Wen Gong <wgong@codeaurora.org>

    [ Upstream commit 49ed34b835e231aa941257394716bc689bc98d9f ]

    For some SDIO chip, the peer id is 65535 for MPDU with error status,
    then test_bit will trigger buffer overflow for peer's memory, if kasan
    enabled, it will report error.

    Reason is when station is in disconnecting status, firmware do not delete
    the peer info since it not disconnected completely, meanwhile some AP will
    still send data packet to station, then hardware will receive the packet
    and send to firmware, firmware's logic will report peer id of 65535 for
    MPDU with error status.

    Add check for overflow the size of peer's peer_ids will avoid the buffer
    overflow access.

    Call trace of kasan:
    dump_backtrace+0x0/0x2ec
    show_stack+0x20/0x2c
    __dump_stack+0x20/0x28
    dump_stack+0xc8/0xec
    print_address_description+0x74/0x240
    kasan_report+0x250/0x26c
    __asan_report_load8_noabort+0x20/0x2c
    ath10k_peer_find_by_id+0x180/0x1e4 [ath10k_core]
    ath10k_htt_t2h_msg_handler+0x100c/0x2fd4 [ath10k_core]
    ath10k_htt_htc_t2h_msg_handler+0x20/0x34 [ath10k_core]
    ath10k_sdio_irq_handler+0xcc8/0x1678 [ath10k_sdio]
    process_sdio_pending_irqs+0xec/0x370
    sdio_run_irqs+0x68/0xe4
    sdio_irq_work+0x1c/0x28
    process_one_work+0x3d8/0x8b0
    worker_thread+0x508/0x7cc
    kthread+0x24c/0x264
    ret_from_fork+0x10/0x18

    Tested with QCA6174 SDIO with firmware
    WLAN.RMH.4.4.1-00007-QCARMSWP-1.

    Signed-off-by: Wen Gong <wgong@codeaurora.org>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/ath10k/txrx.c | 3 +++
    1 file changed, 3 insertions(+)

    diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
    index c5818d28f55a..4102df016931 100644
    --- a/drivers/net/wireless/ath/ath10k/txrx.c
    +++ b/drivers/net/wireless/ath/ath10k/txrx.c
    @@ -150,6 +150,9 @@ struct ath10k_peer *ath10k_peer_find_by_id(struct ath10k *ar, int peer_id)
    {
    struct ath10k_peer *peer;

    + if (peer_id >= BITS_PER_TYPE(peer->peer_ids))
    + return NULL;
    +
    lockdep_assert_held(&ar->data_lock);

    list_for_each_entry(peer, &ar->peers, list)
    --
    2.20.1
    \
     
     \ /
      Last update: 2019-07-15 15:37    [W:3.217 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site