iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers
History
Dokyung Song a16415c8f1 wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() 
commit 6788ba8aed4e28e90f72d68a9d794e34eac17295 upstream.

This patch fixes an intra-object buffer overflow in brcmfmac that occurs
when the device provides a 'bsscfgidx' equal to or greater than the
buffer size. The patch adds a check that leads to a safe failure if that
is the case.

This fixes CVE-2022-3628.

UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
index 52 is out of range for type 'brcmf_if *[16]'
CPU: 0 PID: 1898 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: events brcmf_fweh_event_worker
Call Trace:
 dump_stack_lvl+0x57/0x7d
 ubsan_epilogue+0x5/0x40
 __ubsan_handle_out_of_bounds+0x69/0x80
 ? memcpy+0x39/0x60
 brcmf_fweh_event_worker+0xae1/0xc00
 ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100
 ? rcu_read_lock_sched_held+0xa1/0xd0
 ? rcu_read_lock_bh_held+0xb0/0xb0
 ? lockdep_hardirqs_on_prepare+0x273/0x3e0
 process_one_work+0x873/0x13e0
 ? lock_release+0x640/0x640
 ? pwq_dec_nr_in_flight+0x320/0x320
 ? rwlock_bug.part.0+0x90/0x90
 worker_thread+0x8b/0xd10
 ? __kthread_parkme+0xd9/0x1d0
 ? process_one_work+0x13e0/0x13e0
 kthread+0x379/0x450
 ? _raw_spin_unlock_irq+0x24/0x30
 ? set_kthread_struct+0x100/0x100
 ret_from_fork+0x1f/0x30
================================================================================
general protection fault, probably for non-canonical address 0xe5601c0020023fff: 0000 [#1] SMP KASAN
KASAN: maybe wild-memory-access in range [0x2b0100010011fff8-0x2b0100010011ffff]
CPU: 0 PID: 1898 Comm: kworker/0:2 Tainted: G           O      5.14.0+ #132
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Workqueue: events brcmf_fweh_event_worker
RIP: 0010:brcmf_fweh_call_event_handler.isra.0+0x42/0x100
Code: 89 f5 53 48 89 fb 48 83 ec 08 e8 79 0b 38 fe 48 85 ed 74 7e e8 6f 0b 38 fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 8b 00 00 00 4c 8b 7d 00 44 89 e0 48 ba 00 00 00
RSP: 0018:ffffc9000259fbd8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff888115d8cd50 RCX: 0000000000000000
RDX: 0560200020023fff RSI: ffffffff8304bc91 RDI: ffff888115d8cd50
RBP: 2b0100010011ffff R08: ffff888112340050 R09: ffffed1023549809
R10: ffff88811aa4c047 R11: ffffed1023549808 R12: 0000000000000045
R13: ffffc9000259fca0 R14: ffff888112340050 R15: ffff888112340000
FS:  0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000004053ccc0 CR3: 0000000112740000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
 brcmf_fweh_event_worker+0x117/0xc00
 ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100
 ? rcu_read_lock_sched_held+0xa1/0xd0
 ? rcu_read_lock_bh_held+0xb0/0xb0
 ? lockdep_hardirqs_on_prepare+0x273/0x3e0
 process_one_work+0x873/0x13e0
 ? lock_release+0x640/0x640
 ? pwq_dec_nr_in_flight+0x320/0x320
 ? rwlock_bug.part.0+0x90/0x90
 worker_thread+0x8b/0xd10
 ? __kthread_parkme+0xd9/0x1d0
 ? process_one_work+0x13e0/0x13e0
 kthread+0x379/0x450
 ? _raw_spin_unlock_irq+0x24/0x30
 ? set_kthread_struct+0x100/0x100
 ret_from_fork+0x1f/0x30
Modules linked in: 88XXau(O) 88x2bu(O)
---[ end trace 41d302138f3ff55a ]---
RIP: 0010:brcmf_fweh_call_event_handler.isra.0+0x42/0x100
Code: 89 f5 53 48 89 fb 48 83 ec 08 e8 79 0b 38 fe 48 85 ed 74 7e e8 6f 0b 38 fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> 3c 02 00 0f 85 8b 00 00 00 4c 8b 7d 00 44 89 e0 48 ba 00 00 00
RSP: 0018:ffffc9000259fbd8 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: ffff888115d8cd50 RCX: 0000000000000000
RDX: 0560200020023fff RSI: ffffffff8304bc91 RDI: ffff888115d8cd50
RBP: 2b0100010011ffff R08: ffff888112340050 R09: ffffed1023549809
R10: ffff88811aa4c047 R11: ffffed1023549808 R12: 0000000000000045
R13: ffffc9000259fca0 R14: ffff888112340050 R15: ffff888112340000
FS:  0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000004053ccc0 CR3: 0000000112740000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Kernel panic - not syncing: Fatal exception

Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
Reviewed-by: Arend van Spriel <aspriel@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Dokyung Song <dokyung.song@gmail.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221021061359.GA550858@laguna
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-11-10 17:57:58 +01:00
..
accessibility
…
acpi
ACPI: video: Force backlight native for more TongFang devices
2022-10-29 10:20:36 +02:00
amba
…
android
binder: fix UAF of alloc->vma in race with munmap()
2022-11-10 17:57:54 +01:00
ata
ata: pata_legacy: fix pdc20230_set_piomode()
2022-11-10 17:57:50 +01:00
atm
atm: idt77252: fix use-after-free bugs caused by tst_timer
2022-08-25 11:18:26 +02:00
auxdisplay
…
base
PM: domains: Fix handling of unavailable/disabled idle states
2022-11-03 23:56:56 +09:00
bcma
…
block
nbd: Fix hung when signal interrupts nbd_start_device_ioctl()
2022-10-26 13:22:56 +02:00
bluetooth
Bluetooth: hci_intel: Add check for platform_driver_register
2022-08-25 11:17:47 +02:00
bus
bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe()
2022-08-25 11:17:35 +02:00
cdrom
…
char
random: use expired timer rather than wq for mixing fast pool
2022-10-15 07:54:40 +02:00
clk
clk: bcm2835: Make peripheral PLLC critical
2022-10-26 13:22:59 +02:00
clocksource
clocksource/drivers/ixp4xx: remove EXPORT_SYMBOL_GPL from ixp4xx_timer_setup()
2022-07-07 17:36:53 +02:00
connector
…
counter
…
cpufreq
x86/devicetable: Move x86 specific macro out of generic code
2022-10-07 09:16:54 +02:00
cpuidle
…
crypto
crypto: cavium - prevent integer overflow loading firmware
2022-10-26 13:22:46 +02:00
dax
dax: make sure inodes are flushed before destroy cache
2022-04-15 14:18:12 +02:00
dca
…
devfreq
PM / devfreq: exynos-ppmu: Fix refcount leak in of_get_devfreq_events
2022-07-07 17:36:49 +02:00
dio
…
dma
dmaengine: ioat: stop mod_timer from resurrecting deleted timer in __cleanup()
2022-10-26 13:22:43 +02:00
dma-buf
udmabuf: Set the DMA mask for the udmabuf device (v2)
2022-09-05 10:27:45 +02:00
edac
EDAC/synopsys: Read the error count from the correct register
2022-04-27 13:50:48 +02:00
eisa
…
extcon
extcon: Modify extcon device to be created after driver data is set
2022-06-14 18:12:00 +02:00
firewire
firewire: core: extend card->lock in fw_core_handle_bus_reset
2022-05-12 12:23:41 +02:00
firmware
efi: random: reduce seed size to 32 bytes
2022-11-10 17:57:55 +01:00
fpga
fpga: altera-pr-ip: fix unsigned comparison with less than zero
2022-08-25 11:17:51 +02:00
fsi
fsi: core: Check error number after calling ida_simple_get
2022-10-26 13:22:41 +02:00
gnss
…
gpio
gpio: mpc8xxx: Fix support for IRQ_TYPE_LEVEL_LOW flow_type in mpc85xx
2022-09-28 11:03:57 +02:00
gpu
drm/i915/sdvo: Setup DDC fully before output init
2022-11-10 17:57:57 +01:00
greybus
greybus: svc: fix an error handling bug in gb_svc_hello()
2022-04-15 14:17:58 +02:00
hid
HID: saitek: add madcatz variant of MMO7 mouse device ID
2022-11-10 17:57:53 +01:00
hsi
HSI: omap_ssi_port: Fix dma_map_sg error check
2022-10-26 13:22:36 +02:00
hv
Drivers: hv: Never allocate anything besides framebuffer from framebuffer memory region
2022-09-28 11:04:08 +02:00
hwmon
hwmon/coretemp: Handle large core ID value
2022-10-29 10:20:34 +02:00
hwspinlock
…
hwtracing
intel_th: pci: Add Meteor Lake-P support
2022-08-25 11:18:13 +02:00
i2c
i2c: xiic: Add platform module alias
2022-11-10 17:57:53 +01:00
i3c
…
ide
…
idle
intel_idle: Disable IBRS during long idle
2022-10-07 09:16:55 +02:00
iio
iio: light: tsl2583: Fix module unloading
2022-11-03 23:56:53 +09:00
infiniband
RDMA/qedr: clean up work queue on failure in qedr_alloc_resources()
2022-11-10 17:57:50 +01:00
input
Input: xpad - fix wireless 360 controller breaking after suspend
2022-10-15 07:54:41 +02:00
interconnect
…
iommu
iommu/vt-d: Clean up si_domain in the init_dmars() error path
2022-10-29 10:20:35 +02:00
ipack
…
irqchip
irqchip/tegra: Fix overflow implicit truncation warnings
2022-08-25 11:18:32 +02:00
isdn
isdn: mISDN: netjet: fix wrong check of device registration
2022-11-10 17:57:51 +01:00
leds
…
lightnvm
lightnvm: disable the subsystem
2022-05-09 09:03:20 +02:00
macintosh
macintosh/adb: fix oob read in do_adb_query() function
2022-08-11 12:57:53 +02:00
mailbox
mailbox: bcm-ferxrm-mailbox: Fix error check for dma_map_sg
2022-10-26 13:22:44 +02:00
mcb
…
md
md: Replace snprintf with scnprintf
2022-10-26 13:23:00 +02:00
media
media: dvb-frontends/drxk: initialize err to 0
2022-11-10 17:57:53 +01:00
memory
memory: of: Fix refcount leak bug in of_get_ddr_timings()
2022-10-26 13:22:31 +02:00
memstick
memstick/ms_block: Fix a memory leak
2022-08-25 11:17:55 +02:00
message
…
mfd
mfd: sm501: Add check for platform_driver_register()
2022-10-26 13:22:42 +02:00
misc
misc: ocxl: fix possible refcount leak in afu_ioctl()
2022-10-26 13:22:37 +02:00
mmc
mmc: core: Fix kernel panic when remove non-standard SDIO card
2022-11-03 23:56:54 +09:00
mtd
mtd: rawnand: gpmi: Set WAIT_FOR_READY timeout based on program/erase times
2022-11-10 17:57:57 +01:00
mux
…
net
wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
2022-11-10 17:57:58 +01:00
nfc
nfc: nfcmrvl: Fix potential memory leak in nfcmrvl_i2c_nci_send()
2022-11-10 17:57:50 +01:00
ntb
NTB: ntb_tool: uninitialized heap data in tool_fn_write()
2022-08-25 11:18:26 +02:00
nubus
…
nvdimm
nvdimm: Fix badblocks clear off-by-one error
2022-07-07 17:36:48 +02:00
nvme
nvmet-tcp: add bounds check on Transfer Tag
2022-10-26 13:22:58 +02:00
nvmem
…
of
of: mdio: Add of_node_put() when breaking out of for_each_xx
2022-09-28 11:04:06 +02:00
opp
opp: Fix error check in dev_pm_opp_attach_genpd()
2022-08-25 11:18:00 +02:00
oprofile
…
parisc
parisc: Export iosapic_serial_irq() symbol for serial port driver
2022-11-10 17:57:56 +01:00
parport
…
pci
PCI: Sanitise firmware BAR assignments behind a PCI-PCI bridge
2022-10-26 13:22:16 +02:00
pcmcia
pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards
2022-06-14 18:11:50 +02:00
perf
perf/arm_pmu_platform: fix tests for platform_get_irq() failure
2022-09-20 12:27:59 +02:00
phy
phy: qualcomm: call clk_disable_unprepare in the error handling
2022-10-26 13:22:40 +02:00
pinctrl
pinctrl: amd: Don't save/restore interrupt status and wake status bits
2022-09-05 10:27:39 +02:00
platform
platform/x86: msi-laptop: Change DMI match / alias strings to fix module autoloading
2022-10-26 13:22:53 +02:00
pnp
…
power
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
2022-10-26 13:22:56 +02:00
powercap
powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue
2022-10-26 13:22:47 +02:00
pps
…
ps3
…
ptp
ptp: replace snprintf with sysfs_emit
2022-04-15 14:18:32 +02:00
pwm
pwm: lp3943: Fix duty calculation in case period was clamped
2022-06-14 18:11:51 +02:00
rapidio
…
ras
…
regulator
regulator: qcom_rpm: Fix circular deferral regression
2022-10-26 13:22:15 +02:00
remoteproc
remoteproc: qcom: wcnss: Fix handling of IRQs
2022-08-25 11:18:02 +02:00
reset
reset: tegra-bpmp: Restore Handle errors in BPMP response
2022-04-27 13:50:47 +02:00
rpmsg
rpmsg: qcom: glink: replace strncpy() with strscpy_pad()
2022-10-15 07:54:38 +02:00
rtc
rtc: mt6397: check return value after calling platform_get_resource()
2022-06-14 18:11:53 +02:00
s390
s390/dasd: fix Oops in dasd_alias_get_start_dev due to missing pavgroup
2022-09-28 11:04:08 +02:00
sbus
…
scsi
scsi: core: Restrict legal sdev_state transitions via sysfs
2022-11-10 17:57:53 +01:00
sfi
…
sh
…
siox
…
slimbus
slimbus: qcom: Fix IRQ check in qcom_slim_probe
2022-05-18 09:47:27 +02:00
soc
soc: qcom: smem_state: Add refcounting for the 'state->of_node'
2022-10-26 13:22:32 +02:00
soundwire
soundwire: bus_type: fix remove and shutdown support
2022-08-25 11:17:54 +02:00
spi
spi: s3c64xx: Fix large transfers with DMA
2022-10-26 13:22:25 +02:00
spmi
spmi: pmic-arb: correct duplicate APID to PPID mapping logic
2022-10-26 13:22:43 +02:00
ssb
…
staging
media: meson: vdec: fix possible refcount leak in vdec_probe()
2022-11-10 17:57:53 +01:00
target
scsi: target: tcmu: Fix possible page UAF
2022-04-20 09:19:36 +02:00
tc
…
tee
tee: add overflow check in register_shm_helper()
2022-08-25 11:18:27 +02:00
thermal
thermal: intel_powerclamp: Use first online CPU as control_cpu
2022-10-26 13:23:01 +02:00
thunderbolt
thunderbolt: Use the actual buffer in tb_async_error()
2022-09-15 12:04:52 +02:00
tty
parisc: Make 8250_gsc driver dependend on CONFIG_PARISC
2022-11-10 17:57:56 +01:00
uio
…
usb
xhci: Remove device endpoints from bandwidth list when freeing the device
2022-11-03 23:56:53 +09:00
vfio
vfio: Clear the caps->buf to NULL after free
2022-08-25 11:18:36 +02:00
vhost
vhost/vsock: Use kvmalloc/kvfree for larger packets.
2022-10-26 13:22:25 +02:00
video
fbdev: smscufx: Fix several use-after-free bugs
2022-11-03 23:56:53 +09:00
virt
vboxguest: Do not use devm for irq
2022-08-25 11:18:33 +02:00
virtio
virtio_mmio: Restore guest page size on resume
2022-07-21 20:59:24 +02:00
visorbus
…
vlynq
…
vme
…
w1
w1: w1_therm: fixes w1_seq for ds28ea00 sensors
2022-04-15 14:18:35 +02:00
watchdog
watchdog: armada_37xx_wdt: check the return value of devm_ioremap() in armada_37xx_wdt_probe()
2022-08-25 11:18:06 +02:00
xen
xen/gntdev: Prevent leaking grants
2022-11-03 23:56:54 +09:00
zorro
…
Kconfig
…
Makefile
…