* [syzbot] [wireless?] [usb?] UBSAN: array-index-out-of-bounds in htc_issue_send
@ 2024-03-20 14:34 syzbot
2024-03-21 7:31 ` [PATCH usb] wifi: ath9k: fix oob " Edward Adam Davis
0 siblings, 1 reply; 5+ messages in thread
From: syzbot @ 2024-03-20 14:34 UTC (permalink / raw
To: kvalo, linux-kernel, linux-usb, linux-wireless, netdev,
syzkaller-bugs, toke
Hello,
syzbot found the following issue on:
HEAD commit: a788e53c05ae usb: usb-acpi: Fix oops due to freeing uninit..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing
console output: https://syzkaller.appspot.com/x/log.txt?x=1324bffa180000
kernel config: https://syzkaller.appspot.com/x/.config?x=dd8c589043bc2b49
dashboard link: https://syzkaller.appspot.com/bug?extid=93cbd5fbb85814306ba1
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c95c6e180000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1734b9f1180000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/070d17d2f510/disk-a788e53c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/13f35a4bb3f0/vmlinux-a788e53c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6825f1cdc918/bzImage-a788e53c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+93cbd5fbb85814306ba1@syzkaller.appspotmail.com
usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
ath9k_htc 1-1:1.0: ath9k_htc: HTC initialized with 33 credits
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51
index 255 is out of range for type 'htc_endpoint [22]'
CPU: 1 PID: 2494 Comm: kworker/1:2 Not tainted 6.8.0-rc6-syzkaller-00190-ga788e53c05ae #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: events request_firmware_work_func
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:217 [inline]
__ubsan_handle_out_of_bounds+0x111/0x150 lib/ubsan.c:347
htc_issue_send.constprop.0+0x209/0x230 drivers/net/wireless/ath/ath9k/htc_hst.c:26
ath9k_wmi_cmd_issue drivers/net/wireless/ath/ath9k/wmi.c:305 [inline]
ath9k_wmi_cmd+0x424/0x630 drivers/net/wireless/ath/ath9k/wmi.c:342
ath9k_regread+0xdb/0x160 drivers/net/wireless/ath/ath9k/htc_drv_init.c:242
ath9k_hw_read_revisions drivers/net/wireless/ath/ath9k/hw.c:287 [inline]
__ath9k_hw_init drivers/net/wireless/ath/ath9k/hw.c:572 [inline]
ath9k_hw_init+0xf02/0x2b30 drivers/net/wireless/ath/ath9k/hw.c:700
ath9k_init_priv drivers/net/wireless/ath/ath9k/htc_drv_init.c:662 [inline]
ath9k_init_device drivers/net/wireless/ath/ath9k/htc_drv_init.c:839 [inline]
ath9k_htc_probe_device+0xb37/0x25f0 drivers/net/wireless/ath/ath9k/htc_drv_init.c:963
ath9k_htc_hw_init+0x33/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:529
ath9k_hif_usb_firmware_cb+0x272/0x620 drivers/net/wireless/ath/ath9k/hif_usb.c:1273
request_firmware_work_func+0x13a/0x240 drivers/base/firmware_loader/main.c:1163
process_one_work+0x886/0x15d0 kernel/workqueue.c:2633
process_scheduled_works kernel/workqueue.c:2706 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:243
</TASK>
---[ end trace ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH usb] wifi: ath9k: fix oob in htc_issue_send
2024-03-20 14:34 [syzbot] [wireless?] [usb?] UBSAN: array-index-out-of-bounds in htc_issue_send syzbot
@ 2024-03-21 7:31 ` Edward Adam Davis
2024-03-21 7:50 ` Greg KH
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Edward Adam Davis @ 2024-03-21 7:31 UTC (permalink / raw
To: syzbot+93cbd5fbb85814306ba1
Cc: kvalo, linux-kernel, linux-usb, linux-wireless, netdev,
syzkaller-bugs, toke
[syzbot reported]
usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
ath9k_htc 1-1:1.0: ath9k_htc: HTC initialized with 33 credits
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51
index 255 is out of range for type 'htc_endpoint [22]'
CPU: 1 PID: 2494 Comm: kworker/1:2 Not tainted 6.8.0-rc6-syzkaller-00190-ga788e53c05ae #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: events request_firmware_work_func
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:217 [inline]
__ubsan_handle_out_of_bounds+0x111/0x150 lib/ubsan.c:347
htc_issue_send.constprop.0+0x209/0x230 drivers/net/wireless/ath/ath9k/htc_hst.c:26
ath9k_wmi_cmd_issue drivers/net/wireless/ath/ath9k/wmi.c:305 [inline]
ath9k_wmi_cmd+0x424/0x630 drivers/net/wireless/ath/ath9k/wmi.c:342
ath9k_regread+0xdb/0x160 drivers/net/wireless/ath/ath9k/htc_drv_init.c:242
ath9k_hw_read_revisions drivers/net/wireless/ath/ath9k/hw.c:287 [inline]
__ath9k_hw_init drivers/net/wireless/ath/ath9k/hw.c:572 [inline]
ath9k_hw_init+0xf02/0x2b30 drivers/net/wireless/ath/ath9k/hw.c:700
ath9k_init_priv drivers/net/wireless/ath/ath9k/htc_drv_init.c:662 [inline]
ath9k_init_device drivers/net/wireless/ath/ath9k/htc_drv_init.c:839 [inline]
ath9k_htc_probe_device+0xb37/0x25f0 drivers/net/wireless/ath/ath9k/htc_drv_init.c:963
ath9k_htc_hw_init+0x33/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:529
ath9k_hif_usb_firmware_cb+0x272/0x620 drivers/net/wireless/ath/ath9k/hif_usb.c:1273
request_firmware_work_func+0x13a/0x240 drivers/base/firmware_loader/main.c:1163
process_one_work+0x886/0x15d0 kernel/workqueue.c:2633
process_scheduled_works kernel/workqueue.c:2706 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:243
</TASK>
---[ end trace ]---
[Fix]
If the target does not return a valid end point id during the device connection
process, returns a failure.
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Reported-and-tested-by: syzbot+93cbd5fbb85814306ba1@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index eb631fd3336d..0d1115d1cc29 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -295,6 +295,9 @@ int htc_connect_service(struct htc_target *target,
}
*conn_rsp_epid = target->conn_rsp_epid;
+ if (*conn_rsp_epid < 0 || *conn_rsp_epid > ENDPOINT_MAX)
+ return -EINVAL;
+
return 0;
err:
kfree_skb(skb);
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH usb] wifi: ath9k: fix oob in htc_issue_send
2024-03-21 7:31 ` [PATCH usb] wifi: ath9k: fix oob " Edward Adam Davis
@ 2024-03-21 7:50 ` Greg KH
2024-03-21 8:29 ` Kalle Valo
2024-03-21 18:52 ` Toke Høiland-Jørgensen
2 siblings, 0 replies; 5+ messages in thread
From: Greg KH @ 2024-03-21 7:50 UTC (permalink / raw
To: Edward Adam Davis
Cc: syzbot+93cbd5fbb85814306ba1, kvalo, linux-kernel, linux-usb,
linux-wireless, netdev, syzkaller-bugs, toke
On Thu, Mar 21, 2024 at 03:31:33PM +0800, Edward Adam Davis wrote:
> [syzbot reported]
> usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
> ath9k_htc 1-1:1.0: ath9k_htc: HTC initialized with 33 credits
> ------------[ cut here ]------------
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51
> index 255 is out of range for type 'htc_endpoint [22]'
> CPU: 1 PID: 2494 Comm: kworker/1:2 Not tainted 6.8.0-rc6-syzkaller-00190-ga788e53c05ae #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> Workqueue: events request_firmware_work_func
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
> ubsan_epilogue lib/ubsan.c:217 [inline]
> __ubsan_handle_out_of_bounds+0x111/0x150 lib/ubsan.c:347
> htc_issue_send.constprop.0+0x209/0x230 drivers/net/wireless/ath/ath9k/htc_hst.c:26
> ath9k_wmi_cmd_issue drivers/net/wireless/ath/ath9k/wmi.c:305 [inline]
> ath9k_wmi_cmd+0x424/0x630 drivers/net/wireless/ath/ath9k/wmi.c:342
> ath9k_regread+0xdb/0x160 drivers/net/wireless/ath/ath9k/htc_drv_init.c:242
> ath9k_hw_read_revisions drivers/net/wireless/ath/ath9k/hw.c:287 [inline]
> __ath9k_hw_init drivers/net/wireless/ath/ath9k/hw.c:572 [inline]
> ath9k_hw_init+0xf02/0x2b30 drivers/net/wireless/ath/ath9k/hw.c:700
> ath9k_init_priv drivers/net/wireless/ath/ath9k/htc_drv_init.c:662 [inline]
> ath9k_init_device drivers/net/wireless/ath/ath9k/htc_drv_init.c:839 [inline]
> ath9k_htc_probe_device+0xb37/0x25f0 drivers/net/wireless/ath/ath9k/htc_drv_init.c:963
> ath9k_htc_hw_init+0x33/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:529
> ath9k_hif_usb_firmware_cb+0x272/0x620 drivers/net/wireless/ath/ath9k/hif_usb.c:1273
> request_firmware_work_func+0x13a/0x240 drivers/base/firmware_loader/main.c:1163
> process_one_work+0x886/0x15d0 kernel/workqueue.c:2633
> process_scheduled_works kernel/workqueue.c:2706 [inline]
> worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787
> kthread+0x2c6/0x3a0 kernel/kthread.c:388
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:243
> </TASK>
> ---[ end trace ]---
> [Fix]
> If the target does not return a valid end point id during the device connection
> process, returns a failure.
>
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Reported-and-tested-by: syzbot+93cbd5fbb85814306ba1@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
> drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
> index eb631fd3336d..0d1115d1cc29 100644
> --- a/drivers/net/wireless/ath/ath9k/htc_hst.c
> +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
> @@ -295,6 +295,9 @@ int htc_connect_service(struct htc_target *target,
> }
>
> *conn_rsp_epid = target->conn_rsp_epid;
> + if (*conn_rsp_epid < 0 || *conn_rsp_epid > ENDPOINT_MAX)
> + return -EINVAL;
> +
> return 0;
> err:
> kfree_skb(skb);
> --
> 2.43.0
>
>
Hi,
This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
a patch that has triggered this response. He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created. Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.
You are receiving this message because of the following common error(s)
as indicated below:
- You have marked a patch with a "Fixes:" tag for a commit that is in an
older released kernel, yet you do not have a cc: stable line in the
signed-off-by area at all, which means that the patch will not be
applied to any older kernel releases. To properly fix this, please
follow the documented rules in the
Documentation/process/stable-kernel-rules.rst file for how to resolve
this.
If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.
thanks,
greg k-h's patch email bot
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH usb] wifi: ath9k: fix oob in htc_issue_send
2024-03-21 7:31 ` [PATCH usb] wifi: ath9k: fix oob " Edward Adam Davis
2024-03-21 7:50 ` Greg KH
@ 2024-03-21 8:29 ` Kalle Valo
2024-03-21 18:52 ` Toke Høiland-Jørgensen
2 siblings, 0 replies; 5+ messages in thread
From: Kalle Valo @ 2024-03-21 8:29 UTC (permalink / raw
To: Edward Adam Davis
Cc: syzbot+93cbd5fbb85814306ba1, linux-kernel, linux-usb,
linux-wireless, netdev, syzkaller-bugs, toke
Edward Adam Davis <eadavis@qq.com> writes:
> [syzbot reported]
> usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
> ath9k_htc 1-1:1.0: ath9k_htc: HTC initialized with 33 credits
> ------------[ cut here ]------------
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51
> index 255 is out of range for type 'htc_endpoint [22]'
> CPU: 1 PID: 2494 Comm: kworker/1:2 Not tainted 6.8.0-rc6-syzkaller-00190-ga788e53c05ae #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> Workqueue: events request_firmware_work_func
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
> ubsan_epilogue lib/ubsan.c:217 [inline]
> __ubsan_handle_out_of_bounds+0x111/0x150 lib/ubsan.c:347
> htc_issue_send.constprop.0+0x209/0x230 drivers/net/wireless/ath/ath9k/htc_hst.c:26
> ath9k_wmi_cmd_issue drivers/net/wireless/ath/ath9k/wmi.c:305 [inline]
> ath9k_wmi_cmd+0x424/0x630 drivers/net/wireless/ath/ath9k/wmi.c:342
> ath9k_regread+0xdb/0x160 drivers/net/wireless/ath/ath9k/htc_drv_init.c:242
> ath9k_hw_read_revisions drivers/net/wireless/ath/ath9k/hw.c:287 [inline]
> __ath9k_hw_init drivers/net/wireless/ath/ath9k/hw.c:572 [inline]
> ath9k_hw_init+0xf02/0x2b30 drivers/net/wireless/ath/ath9k/hw.c:700
> ath9k_init_priv drivers/net/wireless/ath/ath9k/htc_drv_init.c:662 [inline]
> ath9k_init_device drivers/net/wireless/ath/ath9k/htc_drv_init.c:839 [inline]
> ath9k_htc_probe_device+0xb37/0x25f0 drivers/net/wireless/ath/ath9k/htc_drv_init.c:963
> ath9k_htc_hw_init+0x33/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:529
> ath9k_hif_usb_firmware_cb+0x272/0x620 drivers/net/wireless/ath/ath9k/hif_usb.c:1273
> request_firmware_work_func+0x13a/0x240 drivers/base/firmware_loader/main.c:1163
> process_one_work+0x886/0x15d0 kernel/workqueue.c:2633
> process_scheduled_works kernel/workqueue.c:2706 [inline]
> worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787
> kthread+0x2c6/0x3a0 kernel/kthread.c:388
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:243
> </TASK>
> ---[ end trace ]---
> [Fix]
> If the target does not return a valid end point id during the device connection
> process, returns a failure.
>
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Reported-and-tested-by: syzbot+93cbd5fbb85814306ba1@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
This should go to ath tree, not usb. No need to resend because of this.
--
https://patchwork.kernel.org/project/linux-wireless/list/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH usb] wifi: ath9k: fix oob in htc_issue_send
2024-03-21 7:31 ` [PATCH usb] wifi: ath9k: fix oob " Edward Adam Davis
2024-03-21 7:50 ` Greg KH
2024-03-21 8:29 ` Kalle Valo
@ 2024-03-21 18:52 ` Toke Høiland-Jørgensen
2 siblings, 0 replies; 5+ messages in thread
From: Toke Høiland-Jørgensen @ 2024-03-21 18:52 UTC (permalink / raw
To: Edward Adam Davis, syzbot+93cbd5fbb85814306ba1
Cc: kvalo, linux-kernel, linux-usb, linux-wireless, netdev,
syzkaller-bugs
Edward Adam Davis <eadavis@qq.com> writes:
> [syzbot reported]
> usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008
> ath9k_htc 1-1:1.0: ath9k_htc: HTC initialized with 33 credits
> ------------[ cut here ]------------
> UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26:51
> index 255 is out of range for type 'htc_endpoint [22]'
> CPU: 1 PID: 2494 Comm: kworker/1:2 Not tainted 6.8.0-rc6-syzkaller-00190-ga788e53c05ae #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
> Workqueue: events request_firmware_work_func
> Call Trace:
> <TASK>
> __dump_stack lib/dump_stack.c:88 [inline]
> dump_stack_lvl+0x125/0x1b0 lib/dump_stack.c:106
> ubsan_epilogue lib/ubsan.c:217 [inline]
> __ubsan_handle_out_of_bounds+0x111/0x150 lib/ubsan.c:347
> htc_issue_send.constprop.0+0x209/0x230 drivers/net/wireless/ath/ath9k/htc_hst.c:26
> ath9k_wmi_cmd_issue drivers/net/wireless/ath/ath9k/wmi.c:305 [inline]
> ath9k_wmi_cmd+0x424/0x630 drivers/net/wireless/ath/ath9k/wmi.c:342
> ath9k_regread+0xdb/0x160 drivers/net/wireless/ath/ath9k/htc_drv_init.c:242
> ath9k_hw_read_revisions drivers/net/wireless/ath/ath9k/hw.c:287 [inline]
> __ath9k_hw_init drivers/net/wireless/ath/ath9k/hw.c:572 [inline]
> ath9k_hw_init+0xf02/0x2b30 drivers/net/wireless/ath/ath9k/hw.c:700
> ath9k_init_priv drivers/net/wireless/ath/ath9k/htc_drv_init.c:662 [inline]
> ath9k_init_device drivers/net/wireless/ath/ath9k/htc_drv_init.c:839 [inline]
> ath9k_htc_probe_device+0xb37/0x25f0 drivers/net/wireless/ath/ath9k/htc_drv_init.c:963
> ath9k_htc_hw_init+0x33/0x70 drivers/net/wireless/ath/ath9k/htc_hst.c:529
> ath9k_hif_usb_firmware_cb+0x272/0x620 drivers/net/wireless/ath/ath9k/hif_usb.c:1273
> request_firmware_work_func+0x13a/0x240 drivers/base/firmware_loader/main.c:1163
> process_one_work+0x886/0x15d0 kernel/workqueue.c:2633
> process_scheduled_works kernel/workqueue.c:2706 [inline]
> worker_thread+0x8b9/0x1290 kernel/workqueue.c:2787
> kthread+0x2c6/0x3a0 kernel/kthread.c:388
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:243
> </TASK>
> ---[ end trace ]---
> [Fix]
> If the target does not return a valid end point id during the device connection
> process, returns a failure.
>
> Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
> Reported-and-tested-by: syzbot+93cbd5fbb85814306ba1@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
> drivers/net/wireless/ath/ath9k/htc_hst.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
> index eb631fd3336d..0d1115d1cc29 100644
> --- a/drivers/net/wireless/ath/ath9k/htc_hst.c
> +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
> @@ -295,6 +295,9 @@ int htc_connect_service(struct htc_target *target,
> }
>
> *conn_rsp_epid = target->conn_rsp_epid;
> + if (*conn_rsp_epid < 0 || *conn_rsp_epid > ENDPOINT_MAX)
> + return -EINVAL;
> +
Hmm, there's an off-by-one error here: the arrays in question are
defined as var[ENDPOINT_MAX], so a value of ENDPOINT_MAX is going to
overflow.
IOW, this should be:
+ if (*conn_rsp_epid < 0 || *conn_rsp_epid >= ENDPOINT_MAX)
+ return -EINVAL;
+
-Toke
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2024-03-21 18:52 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-03-20 14:34 [syzbot] [wireless?] [usb?] UBSAN: array-index-out-of-bounds in htc_issue_send syzbot
2024-03-21 7:31 ` [PATCH usb] wifi: ath9k: fix oob " Edward Adam Davis
2024-03-21 7:50 ` Greg KH
2024-03-21 8:29 ` Kalle Valo
2024-03-21 18:52 ` Toke Høiland-Jørgensen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).