Received: by 2002:a05:7412:3784:b0:e2:908c:2ebd with SMTP id jk4csp2652474rdb; Wed, 4 Oct 2023 07:39:08 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHE+voUG+Y72jPczwv8k1DWPPeFVzX7yWpZE5Q4PGyuYkRiPFG6ecQXVhdL/vm7luJ+x7WI X-Received: by 2002:a05:6808:10ce:b0:3ab:83fe:e182 with SMTP id s14-20020a05680810ce00b003ab83fee182mr3135445ois.1.1696430348235; Wed, 04 Oct 2023 07:39:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1696430348; cv=none; d=google.com; s=arc-20160816; b=VGUDELH0uR+DfxqbHDJjOiTvLtlGHCnk9SJZoWPn/eR4F6KSjh+ibpWhiqQ/SN05n7 xAfUBbi5z/XB+GHnZdNkGVQYidHOkWmIbGLLM2dFtoIl2pv68a0MAjrIbiHGRLG6qRvk +nwm6vVuZcIrhtxVAOld+/bGdpD1q+Elb7KkRE4kR9NX7S2lUxiW+tdNfMdgUN2cbaYX IVE8ot449TLOnVnOKMyhmRbXrCJdN8pmvE9MuScFfdlxCqaazrda/NVQ/6p3gRafLwTs gcfzdHgC50YzkZb6tz8urCMztAE836NrtRazDINU+6Qd/WD/IKfMcFcIRXo0qp5Iv19x M1Yw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=y3YKbO1xjf77fZQRPVDTjQb11HLjLTb8krXncktI5+Y=; fh=l3Z2aV90qmmQEEEHFwnn5N0vhtrtmGYYaEe0XcYZqbA=; b=EsHeq+O5VLySyJ7Al2p/qSsihQLlqRDGRgmatinAWtPBakfOA6nXRtMdP+075iiy3a GWyU+djp+vckPAAa4jA8HsogapX+Q503Hnt3si2zGT4POCjmFNjXvesDywch4XLNbo6x NZ3wr+zXu06laasybzyWuPEFjf/9P4BWkjCyp+tp2eigwAAwniCxW/po+itIc+NEoQcK 7tkUWVgJBTMnZLGyBuIlcDQCMZF8SURxRvhTop9ZQmBCLUebgIxCag8Lqv46ULwMf2K4 mTHs7W6q/r/+4+xf4RWQgs31O6m7ewWfEvWLeWGuuSBWj/WFFNUCEqq5FUCZtQ/VLaSE PO+A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=mcst.ru Return-Path: Received: from groat.vger.email (groat.vger.email. [23.128.96.35]) by mx.google.com with ESMTPS id m125-20020a633f83000000b00577f87e6210si3889511pga.332.2023.10.04.07.39.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 04 Oct 2023 07:39:08 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=mcst.ru Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by groat.vger.email (Postfix) with ESMTP id 604378087DD8; Wed, 4 Oct 2023 07:39:04 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at groat.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233624AbjJDOi4 (ORCPT + 99 others); Wed, 4 Oct 2023 10:38:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56778 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232925AbjJDOiz (ORCPT ); Wed, 4 Oct 2023 10:38:55 -0400 Received: from tretyak2.mcst.ru (tretyak2.mcst.ru [212.5.119.215]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4A9BDC0 for ; Wed, 4 Oct 2023 07:38:49 -0700 (PDT) Received: from tretyak2.mcst.ru (localhost [127.0.0.1]) by tretyak2.mcst.ru (Postfix) with ESMTP id 514B1102397; Wed, 4 Oct 2023 17:38:45 +0300 (MSK) Received: from frog.lab.sun.mcst.ru (frog.lab.sun.mcst.ru [176.16.4.50]) by tretyak2.mcst.ru (Postfix) with ESMTP id 4BB9D102395; Wed, 4 Oct 2023 17:38:00 +0300 (MSK) Received: from artemiev-i.lab.sun.mcst.ru (avior-1 [192.168.63.223]) by frog.lab.sun.mcst.ru (8.13.4/8.12.11) with ESMTP id 394Ebxp3003157; Wed, 4 Oct 2023 17:37:59 +0300 From: Igor Artemiev To: Johannes Berg Cc: Igor Artemiev , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org Subject: [lvc-project] [PATCH] wifi: mac80211: fix buffer overflow in ieee80211_rx_get_bigtk() Date: Wed, 4 Oct 2023 17:37:40 +0300 Message-Id: <20231004143740.40933-1-Igor.A.Artemiev@mcst.ru> X-Mailer: git-send-email 2.39.0.152.ga5737674b6 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Anti-Virus: Kaspersky Anti-Virus for Linux Mail Server 5.6.39/RELEASE, bases: 20111107 #2745587, check: 20231004 notchecked X-AV-Checked: ClamAV using ClamSMTP X-Spam-Status: No, score=-0.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on groat.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (groat.vger.email [0.0.0.0]); Wed, 04 Oct 2023 07:39:04 -0700 (PDT) If 'idx' is 0, then 'idx2' is -1, and arrays will be accessed by a negative index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Igor Artemiev --- net/mac80211/rx.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index e751cda5eef6..e686380434bd 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1868,10 +1868,13 @@ ieee80211_rx_get_bigtk(struct ieee80211_rx_data *rx, int idx) key = rcu_dereference(rx->link_sta->gtk[idx]); if (!key) key = rcu_dereference(rx->link->gtk[idx]); - if (!key && rx->link_sta) - key = rcu_dereference(rx->link_sta->gtk[idx2]); - if (!key) - key = rcu_dereference(rx->link->gtk[idx2]); + + if (idx2 >= 0) { + if (!key && rx->link_sta) + key = rcu_dereference(rx->link_sta->gtk[idx2]); + if (!key) + key = rcu_dereference(rx->link->gtk[idx2]); + } return key; } -- 2.30.2