Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Sat, 9 Apr 2022 09:12:25 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Toke =?iso-8859-1?Q?H=F8iland-J=F8rgensen?= <toke@toke.dk>,
        Oleksij Rempel <linux@rempel-privat.de>
Cc:     Kalle Valo <kvalo@kernel.org>, Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        "John W. Linville" <linville@tuxdriver.com>,
        linux-wireless@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] ath9k_htc: fix potential out of bounds access with invalid
 rxstatus->rs_keyix
Message-ID: <20220409061225.GA5447@kili>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?o6SfwkVIhmsStz16erZKTx29YJRAjnvwRBbL6YQcwCsoIKlZj8FA/nnLSv93?=
 =?us-ascii?Q?pSn+0z0E9P8jyxQ90kt17tcQb0D3UYJ+WPM7+PPsNMIx1DzM9dX4H/RFkZNz?=
 =?us-ascii?Q?JLZVTFoXLYX8fE7QdEAmHTjFJaLv0mXfhHuukKsTqVQIbQAf8HMlCCJYz5+F?=
 =?us-ascii?Q?J2SfOKhvX75gcWHsH5A0sLBCZSBNCNVpJ4hKGZnaM2QMKjW4xCqEA3Td0rnd?=
 =?us-ascii?Q?rwT8fMR4c80IbWEg+rEfA4sM5xpNOp1ejJ3eV6l2TODMPaU9kjXfY6SFUEgS?=
 =?us-ascii?Q?ASdCccG4yRMPiyN0+BQ0KC5sW5aAA/D/0UahqB/8boKIBoA/i8pPyoiznSgy?=
 =?us-ascii?Q?wbXnj0o9NjwAYo6nVtPDBn5WDXC6DMPNqWnpFfKzbqbrgyQcYKV06QjwThYe?=
 =?us-ascii?Q?cW0EjvAuh4AgiOqwnjkA/SPOPW2VoFl73GBu1te3qD4lRvzGtAlOvLWUfnbn?=
 =?us-ascii?Q?/kh7B27Ml64rTV1HkFfWE3V57u0UYXgOQJIOwfpCKyepXa9KaZ/dlzTvOaEn?=
 =?us-ascii?Q?1WfwTuI5GLKD+NMd/gAWvLHN934UWV2KUWDx1cpyMEpsHrLLV/LeFQT88d6y?=
 =?us-ascii?Q?goXOPE4cKcQmBf2jib4gVF6aLWbqiY/8Y0ab3WJuBBJK861OdoDny0ZO/One?=
 =?us-ascii?Q?VU+Dv1EkEOVB4lctDj2AvQpS8u3NTBnlCmHhPHJ5niJ41efbxgMjmuAemAoR?=
 =?us-ascii?Q?9/W/ZfhoTQQ4hPPsj5p3mKoPGVMFW1mPobNl7btYPN1rpRpZcDUrqiJ2xnS1?=
 =?us-ascii?Q?i+2VjkHQjak8VOLfzGrZskn1GurbKChiOOkSXus+rLhbXSoS8IfeOXfT2BNX?=
 =?us-ascii?Q?LNLCLfISkkBuy0Wy5gxfp7w8au37z649vl5FDA0rasJEUOwr70wqk9inC+Vy?=
 =?us-ascii?Q?SZUYyk+KJMRRDw13yQngNQd/vgT7HlglC5/IDWHiUhJqB2vqL2LUqnYXRr5z?=
 =?us-ascii?Q?ciPiKinWxXCf6Atp2Z7DB3rA+WYYMmSy3nkU4ENBA93ItGKaeIXmJ2ZclhLc?=
 =?us-ascii?Q?quaCXkdxriV21bzblivnbodsR7kUcP7HfwxgsgdWQK7GhJ69K69xi3+LWLlZ?=
 =?us-ascii?Q?2zZWw2MNFggaktlaanOMHAGgzBCz5G4mPn/lHUy2+GAtyAZfIFK+kmpwSOR7?=
 =?us-ascii?Q?Uf+9snIRWVHAm1JI1pDsCb+QbeCjY4A9YbGOuERMOU8p00jzfaJFInhxSeXc?=
 =?us-ascii?Q?cke9TLxUb1ZU3upJ6NeolftgF5+IGBxE5vdRkB06+NpiR6+gmQqHC6ANQV5U?=
 =?us-ascii?Q?uthlHUFmmGcFWZpVywyIQehX4GzzRk4ychAWllta/B0f4Mgk29nbkvtI3efk?=
 =?us-ascii?Q?CjeE7JuxqSen1lNfmxC13sLX5B7Lx4OtMbwQebNE6T0Faps2J1ZpbFQB+shT?=
 =?us-ascii?Q?LWanKZ3WVN1oFU/+7qkNnuLaOl4Y58TDmKbELtSnMHx0Po+AMVGXvjrR2D7J?=
 =?us-ascii?Q?f2mSJFfJ6DQS5RZF5lJ0TSR+kYb6V06IumnzNSYQDbGrcSDFLYq2orB+1EmB?=
 =?us-ascii?Q?1zzT3Z882ZByMYHiTAF6j8bMQZqFt98S5EOwwkH4fJVc/wIFOGT8z9cWeBLy?=
 =?us-ascii?Q?Y4Qi3TeNZgTWO+Ysp9MyCOY1HJkDDk7LTx7pbteBXNAwCq9QJXA9Tlqd4bXz?=
 =?us-ascii?Q?HDuzQdghhqzNLg3e5/wCsZlf5y+2b/4112o1tJoTKGCO/rXYsUQ8q2ln2XDU?=
 =?us-ascii?Q?sDy5Xfn0sAMQ1oLOgfbVflrmNrK5zj+h27aDTCxyIEw90OoxplWebA4XJrJE?=
 =?us-ascii?Q?tPiX8UgcW1u1woS43HSMfvj7s6AkGmY=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: df66297b-bb5c-4968-305e-08da19eff33e
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Apr 2022 06:12:39.7038
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 25umVXnmVHui/QE2v7Q+SeEBB1xvEErA9wW316ywgEVp4Te+XoPbpiG7DUXtPHOiDNmEIsELe62Al3wvL07M0TXavFLwxZTZcYZ+bP285wA=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR10MB1681
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.425,18.0.858
 definitions=2022-04-08_09:2022-04-08,2022-04-08 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 malwarescore=0
 mlxscore=0 phishscore=0 suspectscore=0 spamscore=0 adultscore=0
 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2202240000 definitions=main-2204090038
X-Proofpoint-ORIG-GUID: b21Mvc9aCknaCQo5jcodYuMbh2p-50rn
X-Proofpoint-GUID: b21Mvc9aCknaCQo5jcodYuMbh2p-50rn
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to
ensure that it is within than bitmap.

drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept()
error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()'

Fixes: 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 6a850a0bfa8a..a23eaca0326d 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -1016,6 +1016,14 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
 		goto rx_next;
 	}
 
+	if (rxstatus->rs_keyix >= ATH_KEYMAX &&
+	    rxstatus->rs_keyix != ATH9K_RXKEYIX_INVALID) {
+		ath_dbg(common, ANY,
+			"Invalid keyix, dropping (keyix: %d)\n",
+			rxstatus->rs_keyix);
+		goto rx_next;
+	}
+
 	/* Get the RX status information */
 
 	memset(rx_status, 0, sizeof(struct ieee80211_rx_status));
-- 
2.20.1