iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers
History
Dokyung Song 7038af4ce9 wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() 
commit 6788ba8aed4e28e90f72d68a9d794e34eac17295 upstream.

This patch fixes an intra-object buffer overflow in brcmfmac that occurs
when the device provides a 'bsscfgidx' equal to or greater than the
buffer size. The patch adds a check that leads to a safe failure if that
is the case.

This fixes CVE-2022-3628.

UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
index 52 is out of range for type 'brcmf_if *[16]'
CPU: 0 PID: 1898 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: events brcmf_fweh_event_worker
Call Trace:
 dump_stack_lvl+0x57/0x7d
 ubsan_epilogue+0x5/0x40
 __ubsan_handle_out_of_bounds+0x69/0x80
 ? memcpy+0x39/0x60
 brcmf_fweh_event_worker+0xae1/0xc00
 ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100
 ? rcu_read_lock_sched_held+0xa1/0xd0
 ? rcu_read_lock_bh_held+0xb0/0xb0
 ? lockdep_hardirqs_on_prepare+0x273/0x3e0
 process_one_work+0x873/0x13e0
 ? lock_release+0x640/0x640
 ? pwq_dec_nr_in_flight+0x320/0x320
 ? rwlock_bug.part.0+0x90/0x90
 worker_thread+0x8b/0xd10
 ? __kthread_parkme+0xd9/0x1d0
 ? process_one_work+0x13e0/0x13e0
 kthread+0x379/0x450
 ? _raw_spin_unlock_irq+0x24/0x30
 ? set_kthread_struct+0x100/0x100
 ret_from_fork+0x1f/0x30
================================================================================
general protection fault, probably for non-canonical address 0xe5601c0020023fff: 0000 [#1] SMP KASAN
KASAN: maybe wild-memory-access in range [0x2b0100010011fff8-0x2b0100010011ffff]
CPU: 0 PID: 1898 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: events brcmf_fweh_event_worker
RIP: 0010:brcmf_fweh_call_event_handler.isra.0+0x42/0x100
Code: 89 f5 53 48 89 fb 48 83 ec 08 e8 79 0b 38 fe 48 85 ed 74 7e e8 6f 0b 38 fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 8b 00 00 00 4c 8b 7d 00 44 89 e0 48 ba 00 00 00
RSP: 0018:ffffc9000259fbd8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff888115d8cd50 RCX: 0000000000000000
RDX: 0560200020023fff RSI: ffffffff8304bc91 RDI: ffff888115d8cd50
RBP: 2b0100010011ffff R08: ffff888112340050 R09: ffffed1023549809
R10: ffff88811aa4c047 R11: ffffed1023549808 R12: 0000000000000045
R13: ffffc9000259fca0 R14: ffff888112340050 R15: ffff888112340000
FS:  0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000004053ccc0 CR3: 0000000112740000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 brcmf_fweh_event_worker+0x117/0xc00
 ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100
 ? rcu_read_lock_sched_held+0xa1/0xd0
 ? rcu_read_lock_bh_held+0xb0/0xb0
 ? lockdep_hardirqs_on_prepare+0x273/0x3e0
 process_one_work+0x873/0x13e0
 ? lock_release+0x640/0x640
 ? pwq_dec_nr_in_flight+0x320/0x320
 ? rwlock_bug.part.0+0x90/0x90
 worker_thread+0x8b/0xd10
 ? __kthread_parkme+0xd9/0x1d0
 ? process_one_work+0x13e0/0x13e0
 kthread+0x379/0x450
 ? _raw_spin_unlock_irq+0x24/0x30
 ? set_kthread_struct+0x100/0x100
 ret_from_fork+0x1f/0x30
Modules linked in: 88XXau(O) 88x2bu(O)
---[ end trace 41d302138f3ff55a ]---
RIP: 0010:brcmf_fweh_call_event_handler.isra.0+0x42/0x100
Code: 89 f5 53 48 89 fb 48 83 ec 08 e8 79 0b 38 fe 48 85 ed 74 7e e8 6f 0b 38 fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 8b 00 00 00 4c 8b 7d 00 44 89 e0 48 ba 00 00 00
RSP: 0018:ffffc9000259fbd8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff888115d8cd50 RCX: 0000000000000000
RDX: 0560200020023fff RSI: ffffffff8304bc91 RDI: ffff888115d8cd50
RBP: 2b0100010011ffff R08: ffff888112340050 R09: ffffed1023549809
R10: ffff88811aa4c047 R11: ffffed1023549808 R12: 0000000000000045
R13: ffffc9000259fca0 R14: ffff888112340050 R15: ffff888112340000
FS:  0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000004053ccc0 CR3: 0000000112740000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Kernel panic - not syncing: Fatal exception

Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Reviewed-by: Arend van Spriel <aspriel@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Dokyung Song <dokyung.song@gmail.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221021061359.GA550858@laguna
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-10 18:15:43 +01:00
..
accessibility
tty: the rest, stop using tty_schedule_flip()
2022-07-29 17:25:32 +02:00
acpi
ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
2022-11-10 18:15:34 +01:00
amba
…
android
binder: remove inaccurate mmap_assert_locked()
2022-09-23 14:15:49 +02:00
ata
ata: pata_legacy: fix pdc20230_set_piomode()
2022-11-10 18:15:28 +01:00
atm
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:40:15 +02:00
auxdisplay
…
base
PM: domains: Fix handling of unavailable/disabled idle states
2022-11-03 23:59:18 +09:00
bcma
…
block
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
2022-10-26 12:35:47 +02:00
bluetooth
Bluetooth: virtio_bt: Use skb_put to set length
2022-11-10 18:15:30 +01:00
bus
bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
2022-08-17 14:23:10 +02:00
cdrom
…
char
hwrng: imx-rngc - Moving IRQ handler registering after imx_rngc_irq_mask_clear()
2022-10-26 12:35:24 +02:00
clk
clk: qcom: Update the force mem core bit for GPU clocks
2022-11-10 18:15:35 +01:00
clocksource
clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup()
2022-07-07 17:53:32 +02:00
comedi
comedi: vmk80xx: fix expression for tx buffer size
2022-06-22 14:22:03 +02:00
connector
…
counter
counter: microchip-tcb-capture: Handle Signal1 read and Synapse
2022-11-03 23:59:13 +09:00
cpufreq
cpufreq: intel_pstate: hybrid: Use known scaling factor for P-cores
2022-11-03 23:59:12 +09:00
cpuidle
cpuidle: PSCI: Improve support for suspend-to-RAM for PSCI OSI mode
2022-06-09 10:22:33 +02:00
crypto
crypto: cavium - prevent integer overflow loading firmware
2022-10-26 12:35:28 +02:00
cxl
cxl/port: Hold port reference until decoder release
2022-07-12 16:34:58 +02:00
dax
devdax: Fix soft-reservation memory description
2022-09-28 11:11:57 +02:00
dca
…
devfreq
PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
2022-07-07 17:53:27 +02:00
dio
…
dma
dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow
2022-10-26 12:35:46 +02:00
dma-buf
udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
2022-10-26 12:35:39 +02:00
edac
EDAC/ghes: Set the DIMM label unconditionally
2022-08-03 12:03:55 +02:00
eisa
…
extcon
extcon: Modify extcon device to be created after driver data is set
2022-06-14 18:36:22 +02:00
firewire
…
firmware
efi: random: Use 'ACPI reclaim' memory for random seed
2022-11-10 18:15:39 +01:00
fpga
fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
2022-10-26 12:35:07 +02:00
fsi
fsi: core: Check error number after calling ida_simple_get
2022-10-26 12:35:17 +02:00
gnss
…
gpio
gpio: rockchip: request GPIO mux to pinctrl when setting direction
2022-10-26 12:34:26 +02:00
gpu
drm/i915/sdvo: Setup DDC fully before output init
2022-11-10 18:15:43 +01:00
greybus
…
hid
HID: saitek: add madcatz variant of MMO7 mouse device ID
2022-11-10 18:15:34 +01:00
hsi
HSI: omap_ssi_port: Fix dma_map_sg error check
2022-10-26 12:35:05 +02:00
hv
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
2022-09-28 11:11:55 +02:00
hwmon
hwmon/coretemp: Handle large core ID value
2022-10-29 10:12:54 +02:00
hwspinlock
…
hwtracing
coresight: cti: Fix hang in cti_disable_hw()
2022-11-03 23:59:13 +09:00
i2c
i2c: piix4: Fix adapter not be removed in piix4_remove()
2022-11-10 18:15:36 +01:00
i3c
…
idle
intel_idle: Disable IBRS during long idle
2022-07-23 12:54:04 +02:00
iio
iio: adxl372: Fix unsafe buffer attributes
2022-11-03 23:59:12 +09:00
infiniband
RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
2022-11-10 18:15:27 +01:00
input
Input: xpad - fix wireless 360 controller breaking after suspend
2022-10-15 07:59:04 +02:00
interconnect
interconnect: imx: fix max_node_id
2022-08-17 14:23:53 +02:00
iommu
iommu/vt-d: Clean up si_domain in the init_dmars() error path
2022-10-29 10:12:57 +02:00
ipack
…
irqchip
irqchip/tegra: Fix overflow implicit truncation warnings
2022-08-25 11:40:32 +02:00
isdn
isdn: mISDN: netjet: fix wrong check of device registration
2022-11-10 18:15:29 +01:00
leds
leds: lm3601x: Don't use mutex after it was destroyed
2022-10-26 12:34:39 +02:00
macintosh
macintosh/adb: fix oob read in do_adb_query() function
2022-08-11 13:07:54 +02:00
mailbox
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
2022-10-26 12:35:21 +02:00
mcb
…
md
dm: remove unnecessary assignment statement in alloc_dev()
2022-10-29 10:12:56 +02:00
media
media: dvb-frontends/drxk: initialize err to 0
2022-11-10 18:15:34 +01:00
memory
memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
2022-10-26 12:34:58 +02:00
memstick
memstick/ms_block: Fix a memory leak
2022-08-17 14:23:50 +02:00
message
…
mfd
mfd: sm501: Add check for platform_driver_register()
2022-10-26 12:35:18 +02:00
misc
misc: ocxl: fix possible refcount leak in afu_ioctl()
2022-10-26 12:35:07 +02:00
mmc
mmc: block: Remove error check of hw_reset on reset
2022-11-03 23:59:14 +09:00
most
…
mtd
mtd: parsers: bcm47xxpart: Fix halfblock reads
2022-11-10 18:15:32 +01:00
mux
…
net
wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
2022-11-10 18:15:43 +01:00
nfc
nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
2022-11-10 18:15:28 +01:00
ntb
NTB: ntb_tool: uninitialized heap data in tool_fn_write()
2022-08-25 11:40:14 +02:00
nubus
…
nvdimm
nvdimm: Fix badblocks clear off-by-one error
2022-07-07 17:53:24 +02:00
nvme
nvmet: fix workqueue MEM_RECLAIM flushing dependency
2022-10-29 10:12:56 +02:00
nvmem
nvmem: core: Fix memleak in nvmem_register()
2022-10-26 12:34:23 +02:00
of
of: fdt: fix off-by-one error in unflatten_dt_nodes()
2022-09-23 14:15:46 +02:00
opp
opp: Fix error check in dev_pm_opp_attach_genpd()
2022-08-17 14:24:01 +02:00
parisc
parisc: Export iosapic_serial_irq() symbol for serial port driver
2022-11-10 18:15:40 +01:00
parport
…
pci
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
2022-10-26 12:34:24 +02:00
pcmcia
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
2022-06-14 18:36:02 +02:00
perf
perf/arm_pmu_platform: fix tests for platform_get_irq() failure
2022-09-20 12:39:45 +02:00
phy
phy: qualcomm: call clk_disable_unprepare in the error handling
2022-10-26 12:35:14 +02:00
pinctrl
pinctrl: Ingenic: JZ4755 bug fixes
2022-11-03 23:59:13 +09:00
platform
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
2022-10-26 12:35:40 +02:00
pnp
…
power
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
2022-10-26 12:35:47 +02:00
powercap
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
2022-10-26 12:35:30 +02:00
pps
…
ps3
…
ptp
…
pwm
pwm: lpc18xx: Fix period handling
2022-08-17 14:23:16 +02:00
rapidio
…
ras
…
regulator
regulator: core: Prevent integer underflow
2022-10-26 12:35:35 +02:00
remoteproc
remoteproc: sysmon: Wait for SSCTL service to come up
2022-08-17 14:24:09 +02:00
reset
reset: imx7: Fix the iMX8MP PCIe PHY PERST support
2022-10-05 10:39:40 +02:00
rpmsg
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
2022-10-12 09:53:28 +02:00
rtc
rtc: rx8025: fix 12/24 hour mode detection on RX-8035
2022-08-17 14:22:53 +02:00
s390
s390/cio: fix out-of-bounds access on cio_ignore free
2022-11-10 18:15:33 +01:00
sbus
…
scsi
scsi: core: Restrict legal sdev_state transitions via sysfs
2022-11-10 18:15:34 +01:00
sh
…
siox
…
slimbus
slimbus: qcom-ngd-ctrl: allow compile testing without QCOM_RPROC_COMMON
2022-10-26 12:35:14 +02:00
soc
soc/tegra: fuse: Drop Kconfig dependency on TEGRA20_APB_DMA
2022-10-26 12:35:00 +02:00
soundwire
soundwire: intel: fix error handling on dai registration issues
2022-10-26 12:35:48 +02:00
spi
spi: Ensure that sg_table won't be used after being freed
2022-10-26 12:34:48 +02:00
spmi
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
2022-10-26 12:35:19 +02:00
ssb
…
staging
media: meson: vdec: fix possible refcount leak in vdec_probe()
2022-11-10 18:15:34 +01:00
target
target: remove an incorrect unmap zeroes data deduction
2022-06-09 10:22:47 +02:00
tc
…
tee
tee: Fix tee_shm_register() for kernel TEE drivers
2022-11-10 18:15:42 +01:00
thermal
thermal: intel_powerclamp: Use first online CPU as control_cpu
2022-10-26 12:35:56 +02:00
thunderbolt
thunderbolt: Add back Intel Falcon Ridge end-to-end flow control workaround
2022-10-26 12:35:34 +02:00
tty
parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
2022-11-10 18:15:40 +01:00
uio
…
usb
xhci: Remove device endpoints from bandwidth list when freeing the device
2022-11-03 23:59:11 +09:00
vdpa
vdpa/ifcvf: fix the calculation of queuepair
2022-10-05 10:39:43 +02:00
vfio
vfio/type1: Unpin zero pages
2022-09-15 11:30:02 +02:00
vhost
vhost/vsock: Use kvmalloc/kvfree for larger packets.
2022-10-26 12:34:47 +02:00
video
fbdev: stifb: Fall back to cfb_fillrect() on 32-bit HCRX cards
2022-11-10 18:15:32 +01:00
virt
vboxguest: Do not use devm for irq
2022-08-25 11:40:33 +02:00
virtio
virtio_mmio: Restore guest page size on resume
2022-07-21 21:24:33 +02:00
visorbus
…
vlynq
…
vme
…
w1
…
watchdog
watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
2022-08-17 14:24:11 +02:00
xen
xen/gntdev: Accommodate VMA splitting
2022-10-26 12:34:24 +02:00
zorro
…
Kconfig
…
Makefile
…