| Message ID | 20190415145646.GA16597@embeddedor |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | David Miller |
| Headers | show |
| Series | wil6210: fix potential out-of-bounds read | expand |
On 2019-04-15 17:56, Gustavo A. R. Silva wrote: > Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h: > > enum gro_result { > GRO_MERGED, > GRO_MERGED_FREE, > GRO_HELD, > GRO_NORMAL, > GRO_DROP, > GRO_CONSUMED, > }; > typedef enum gro_result gro_result_t; > > In case *rc* evaluates to 5, we end up having an out-of-bounds read > at drivers/net/wireless/ath/wil6210/txrx.c:821: > > wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n", > len, gro_res_str[rc]); > > Fix this by adding element "GRO_CONSUMED" to array gro_res_str. > > Addresses-Coverity-ID: 1444666 ("Out-of-bounds read") > Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result") > Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> > --- > drivers/net/wireless/ath/wil6210/txrx.c | 1 + > 1 file changed, 1 insertion(+) Reviewed-by: Maya Erez <merez@codeaurora.org>
On 4/15/19 12:24 PM, merez@codeaurora.org wrote: > On 2019-04-15 17:56, Gustavo A. R. Silva wrote: >> Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h: >> >> enum gro_result { >> GRO_MERGED, >> GRO_MERGED_FREE, >> GRO_HELD, >> GRO_NORMAL, >> GRO_DROP, >> GRO_CONSUMED, >> }; >> typedef enum gro_result gro_result_t; >> >> In case *rc* evaluates to 5, we end up having an out-of-bounds read >> at drivers/net/wireless/ath/wil6210/txrx.c:821: >> >> wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n", >> len, gro_res_str[rc]); >> >> Fix this by adding element "GRO_CONSUMED" to array gro_res_str. >> >> Addresses-Coverity-ID: 1444666 ("Out-of-bounds read") >> Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result") >> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> >> --- >> drivers/net/wireless/ath/wil6210/txrx.c | 1 + >> 1 file changed, 1 insertion(+) > > Reviewed-by: Maya Erez <merez@codeaurora.org> > Thanks, Maya. -- Gustavo
"Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote: > Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h: > > enum gro_result { > GRO_MERGED, > GRO_MERGED_FREE, > GRO_HELD, > GRO_NORMAL, > GRO_DROP, > GRO_CONSUMED, > }; > typedef enum gro_result gro_result_t; > > In case *rc* evaluates to 5, we end up having an out-of-bounds read > at drivers/net/wireless/ath/wil6210/txrx.c:821: > > wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n", > len, gro_res_str[rc]); > > Fix this by adding element "GRO_CONSUMED" to array gro_res_str. > > Addresses-Coverity-ID: 1444666 ("Out-of-bounds read") > Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result") > Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> > Reviewed-by: Maya Erez <merez@codeaurora.org> > Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Patch applied to ath-next branch of ath.git, thanks. bfabdd699732 wil6210: fix potential out-of-bounds read
On 4/29/19 10:00 AM, Kalle Valo wrote: > "Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote: > >> Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h: >> >> enum gro_result { >> GRO_MERGED, >> GRO_MERGED_FREE, >> GRO_HELD, >> GRO_NORMAL, >> GRO_DROP, >> GRO_CONSUMED, >> }; >> typedef enum gro_result gro_result_t; >> >> In case *rc* evaluates to 5, we end up having an out-of-bounds read >> at drivers/net/wireless/ath/wil6210/txrx.c:821: >> >> wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n", >> len, gro_res_str[rc]); >> >> Fix this by adding element "GRO_CONSUMED" to array gro_res_str. >> >> Addresses-Coverity-ID: 1444666 ("Out-of-bounds read") >> Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result") >> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> >> Reviewed-by: Maya Erez <merez@codeaurora.org> >> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> > > Patch applied to ath-next branch of ath.git, thanks. > > bfabdd699732 wil6210: fix potential out-of-bounds read > Awesome. :) Thanks, Kalle. -- Gustavo
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c index 4ccfd1404458..d74837cce67f 100644 --- a/drivers/net/wireless/ath/wil6210/txrx.c +++ b/drivers/net/wireless/ath/wil6210/txrx.c @@ -750,6 +750,7 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev) [GRO_HELD] = "GRO_HELD", [GRO_NORMAL] = "GRO_NORMAL", [GRO_DROP] = "GRO_DROP", + [GRO_CONSUMED] = "GRO_CONSUMED", }; wil->txrx_ops.get_netif_rx_params(skb, &cid, &security);
Notice that *rc* can evaluate to up to 5, include/linux/netdevice.h: enum gro_result { GRO_MERGED, GRO_MERGED_FREE, GRO_HELD, GRO_NORMAL, GRO_DROP, GRO_CONSUMED, }; typedef enum gro_result gro_result_t; In case *rc* evaluates to 5, we end up having an out-of-bounds read at drivers/net/wireless/ath/wil6210/txrx.c:821: wil_dbg_txrx(wil, "Rx complete %d bytes => %s\n", len, gro_res_str[rc]); Fix this by adding element "GRO_CONSUMED" to array gro_res_str. Addresses-Coverity-ID: 1444666 ("Out-of-bounds read") Fixes: 194b482b5055 ("wil6210: Debug print GRO Rx result") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> --- drivers/net/wireless/ath/wil6210/txrx.c | 1 + 1 file changed, 1 insertion(+)