mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-11-09 15:07:03 +00:00
6ce708f54c
Large pkt_len can lead to out-out-bound memcpy. Current ath9k_hif_usb_rx_stream allows combining the content of two urb inputs to one pkt. The first input can indicate the size of the pkt. Any remaining size is saved in hif_dev->rx_remain_len. While processing the next input, memcpy is used with rx_remain_len. 4-byte pkt_len can go up to 0xffff, while a single input is 0x4000 maximum in size (MAX_RX_BUF_SIZE). Thus, the patch adds a check for pkt_len which must not exceed 2 * MAX_RX_BUG_SIZE. BUG: KASAN: slab-out-of-bounds in ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] Read of size 46393 at addr ffff888018798000 by task kworker/0:1/23 CPU: 0 PID: 23 Comm: kworker/0:1 Not tainted 5.6.0 #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-prebuilt.qemu-project.org 04/01/2014 Workqueue: events request_firmware_work_func Call Trace: <IRQ> dump_stack+0x76/0xa0 print_address_description.constprop.0+0x16/0x200 ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] __kasan_report.cold+0x37/0x7c ? ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] kasan_report+0xe/0x20 check_memory_region+0x15a/0x1d0 memcpy+0x20/0x50 ath9k_hif_usb_rx_cb+0x490/0xed7 [ath9k_htc] ? hif_usb_mgmt_cb+0x2d9/0x2d9 [ath9k_htc] ? _raw_spin_lock_irqsave+0x7b/0xd0 ? _raw_spin_trylock_bh+0x120/0x120 ? __usb_unanchor_urb+0x12f/0x210 __usb_hcd_giveback_urb+0x1e4/0x380 usb_giveback_urb_bh+0x241/0x4f0 ? __hrtimer_run_queues+0x316/0x740 ? __usb_hcd_giveback_urb+0x380/0x380 tasklet_action_common.isra.0+0x135/0x330 __do_softirq+0x18c/0x634 irq_exit+0x114/0x140 smp_apic_timer_interrupt+0xde/0x380 apic_timer_interrupt+0xf/0x20 I found the bug using a custome USBFuzz port. It's a research work to fuzz USB stack/drivers. I modified it to fuzz ath9k driver only, providing hand-crafted usb descriptors to QEMU. After fixing the value of pkt_tag to ATH_USB_RX_STREAM_MODE_TAG in QEMU emulation, I found the KASAN report. The bug is triggerable whenever pkt_len is above two MAX_RX_BUG_SIZE. I used the same input that crashes to test the driver works when applying the patch. Signed-off-by: Zekun Shen <bruceshenzk@gmail.com> Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Link: https://lore.kernel.org/r/YXsidrRuK6zBJicZ@10-18-43-117.dynapool.wireless.nyu.edu |
||
|---|---|---|
| .. | ||
| ahb.c | ||
| ani.c | ||
| ani.h | ||
| antenna.c | ||
| ar953x_initvals.h | ||
| ar955x_1p0_initvals.h | ||
| ar956x_initvals.h | ||
| ar5008_initvals.h | ||
| ar5008_phy.c | ||
| ar9001_initvals.h | ||
| ar9002_calib.c | ||
| ar9002_hw.c | ||
| ar9002_initvals.h | ||
| ar9002_mac.c | ||
| ar9002_phy.c | ||
| ar9002_phy.h | ||
| ar9003_2p2_initvals.h | ||
| ar9003_aic.c | ||
| ar9003_aic.h | ||
| ar9003_buffalo_initvals.h | ||
| ar9003_calib.c | ||
| ar9003_eeprom.c | ||
| ar9003_eeprom.h | ||
| ar9003_hw.c | ||
| ar9003_mac.c | ||
| ar9003_mac.h | ||
| ar9003_mci.c | ||
| ar9003_mci.h | ||
| ar9003_paprd.c | ||
| ar9003_phy.c | ||
| ar9003_phy.h | ||
| ar9003_rtt.c | ||
| ar9003_rtt.h | ||
| ar9003_wow.c | ||
| ar9330_1p1_initvals.h | ||
| ar9330_1p2_initvals.h | ||
| ar9340_initvals.h | ||
| ar9462_2p0_initvals.h | ||
| ar9462_2p1_initvals.h | ||
| ar9485_initvals.h | ||
| ar9565_1p0_initvals.h | ||
| ar9565_1p1_initvals.h | ||
| ar9580_1p0_initvals.h | ||
| ath9k_pci_owl_loader.c | ||
| ath9k.h | ||
| beacon.c | ||
| btcoex.c | ||
| btcoex.h | ||
| calib.c | ||
| calib.h | ||
| channel.c | ||
| common-beacon.c | ||
| common-beacon.h | ||
| common-debug.c | ||
| common-debug.h | ||
| common-init.c | ||
| common-init.h | ||
| common-spectral.c | ||
| common-spectral.h | ||
| common.c | ||
| common.h | ||
| debug_sta.c | ||
| debug.c | ||
| debug.h | ||
| dfs_debug.c | ||
| dfs_debug.h | ||
| dfs.c | ||
| dfs.h | ||
| dynack.c | ||
| dynack.h | ||
| eeprom_4k.c | ||
| eeprom_9287.c | ||
| eeprom_def.c | ||
| eeprom.c | ||
| eeprom.h | ||
| gpio.c | ||
| hif_usb.c | ||
| hif_usb.h | ||
| htc_drv_beacon.c | ||
| htc_drv_debug.c | ||
| htc_drv_gpio.c | ||
| htc_drv_init.c | ||
| htc_drv_main.c | ||
| htc_drv_txrx.c | ||
| htc_hst.c | ||
| htc_hst.h | ||
| htc.h | ||
| hw-ops.h | ||
| hw.c | ||
| hw.h | ||
| init.c | ||
| Kconfig | ||
| link.c | ||
| mac.c | ||
| mac.h | ||
| main.c | ||
| Makefile | ||
| mci.c | ||
| mci.h | ||
| pci.c | ||
| phy.h | ||
| recv.c | ||
| reg_aic.h | ||
| reg_mci.h | ||
| reg_wow.h | ||
| reg.h | ||
| rng.c | ||
| tx99.c | ||
| wmi.c | ||
| wmi.h | ||
| wow.c | ||
| xmit.c | ||