raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

ath9k: fix OOB read ar9300_eeprom_restore_internal

Browse Source 
[ Upstream commit 23151b9ae7 ]

Bad header can have large length field which can cause OOB.
cptr is the last bytes for read, and the eeprom is parsed
from high to low address. The OOB, triggered by the condition
length > cptr could cause memory error with a read on
negative index.

There are some sanity check around length, but it is not
compared with cptr (the remaining bytes). Here, the
corrupted/bad EEPROM can cause panic.

I was able to reproduce the crash, but I cannot find the
log and the reproducer now. After I applied the patch, the
bug is no longer reproducible.

Signed-off-by: Zekun Shen <bruceshenzk@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/YM3xKsQJ0Hw2hjrc@Zekuns-MBP-16.fios-router.home
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Zekun Shen
2021-06-19 09:29:14 -04:00
committed by Greg Kroah-Hartman
parent 737e28acee
commit 047bd61b49
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
View File

@@ -3351,7 +3351,8 @@ found:
"Found block at %x: code=%d ref=%d length=%d major=%d minor=%d\n", "Found block at %x: code=%d ref=%d length=%d major=%d minor=%d\n",
cptr, code, reference, length, major, minor); cptr, code, reference, length, major, minor);
if ((!AR_SREV_9485(ah) && length >= 1024) || if ((!AR_SREV_9485(ah) && length >= 1024) ||
(AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485)) { (AR_SREV_9485(ah) && length > EEPROM_DATA_LEN_9485) ||
(length > cptr)) {
ath_dbg(common, EEPROM, "Skipping bad header\n"); ath_dbg(common, EEPROM, "Skipping bad header\n");
cptr -= COMP_HDR_LEN; cptr -= COMP_HDR_LEN;
continue; continue;