From patchwork Fri Dec 20 08:28:31 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Carl Huang X-Patchwork-Id: 11304981 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B4564921 for ; Fri, 20 Dec 2019 08:28:55 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 91AC3227BF for ; Fri, 20 Dec 2019 08:28:55 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="G6q6PVau"; dkim=fail reason="key not found in DNS" (0-bit key) header.d=mg.codeaurora.org header.i=@mg.codeaurora.org header.b="kz4Frjyx" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 91AC3227BF Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=ath11k-bounces+patchwork-ath11k=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:List-Subscribe:List-Help: List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date:Subject:To: From:Reply-To:Cc:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=52IhaHN3z0X+M6zL4G8civdl7W/vNDm4QkLeJ/Eh7/I=; b=G6q6PVauBLtYG8 6eaLjkt38EtU2wKbp84k2rnkjg9L9Rdrn/4A1hLopIdiui9t7iq4+VUZPqO9vVGdAziun6MM1YItd gv2Ny44IBobp3r2b1/yDiAn/gRdkwb4m3e8bEMQuqrGqtOBZiit9NWXagJDer4J85UU9FHZkJMc5k dtO3p2LPiGOhEguhojf3bhfB5Sz3I5xPyu1ucuIaYzZw/ihbPG4NEaeZmgQ/6KT6jU5fUNGLkO6kr B4bse4ssQyR5relH4NUq2cf3gYDee5NuT7FfH/vXrsR2kEVUBXp7uyNkmS6jS6ePjJoNjHPLrLpNK W42aliwq0BsIHnuhiCHQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1iiDeX-0003dn-MK; Fri, 20 Dec 2019 08:28:53 +0000 Received: from mail25.static.mailgun.info ([104.130.122.25]) by bombadil.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1iiDeO-0003UO-5d for ath11k@lists.infradead.org; Fri, 20 Dec 2019 08:28:46 +0000 DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.codeaurora.org; q=dns/txt; s=smtp; t=1576830524; h=Message-Id: Date: Subject: To: From: Sender; bh=gLw8PxsayIKEmH2NmYUxEsyy/IHN3IouITRpQr4FxRA=; b=kz4FrjyxxGIBcGR/xjQBHDbmYzrO2xAqvPMZy2gsZ/jehZvIa5RUTehFpi+kSD5RQtA3vPZZ qXOXtIAGehDmOmle+VOarMkUX1ZFO5CAnMo6aPiqJb8Fnx0ipqq0zkwmloardTgR1mfe5vb1 bDo6UP7jAatlwKaVEPzCeu3jRmc= X-Mailgun-Sending-Ip: 104.130.122.25 X-Mailgun-Sid: WyJmOGQ2ZiIsICJhdGgxMWtAbGlzdHMuaW5mcmFkZWFkLm9yZyIsICJiZTllNGEiXQ== Received: from smtp.codeaurora.org (ec2-35-166-182-171.us-west-2.compute.amazonaws.com [35.166.182.171]) by mxa.mailgun.org with ESMTP id 5dfc8637.7f9b4320dce0-smtp-out-n01; Fri, 20 Dec 2019 08:28:39 -0000 (UTC) Received: by smtp.codeaurora.org (Postfix, from userid 1001) id D7DE0C447A4; Fri, 20 Dec 2019 08:28:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-caf-mail-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=2.0 tests=ALL_TRUSTED,SPF_NONE, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from cjhuang-station.qca.qualcomm.com (unknown [180.166.53.21]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: cjhuang) by smtp.codeaurora.org (Postfix) with ESMTPSA id B1BACC447A2 for ; Fri, 20 Dec 2019 08:28:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org B1BACC447A2 Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; spf=none smtp.mailfrom=cjhuang@codeaurora.org From: Carl Huang To: ath11k@lists.infradead.org Subject: [PATCH qca6390-bringup] ath11k: fix memory OOB access in qmi_decode Date: Fri, 20 Dec 2019 16:28:31 +0800 Message-Id: <1576830511-30561-1-git-send-email-cjhuang@codeaurora.org> X-Mailer: git-send-email 2.7.4 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20191220_002844_680008_EBEFE618 X-CRM114-Status: GOOD ( 10.33 ) X-Spam-Score: -0.0 (/) X-Spam-Report: SpamAssassin version 3.4.2 on bombadil.infradead.org summary: Content analysis details: (-0.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [104.130.122.25 listed in list.dnswl.org] -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [104.130.122.25 listed in wl.mailspike.net] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid X-BeenThere: ath11k@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: "ath11k" Errors-To: ath11k-bounces+patchwork-ath11k=patchwork.kernel.org@lists.infradead.org The decoded_size is wrongly assigned in ath11k_qmi_msg_handlers and it results in out of boundary access in qmi_decode. The correct decoded_size should be calculated from the related ind_msg structure. This issue is exposed with QCA6390 because QCA6390 needs 11 small memory chunks which are stored in qmi_wlanfw_request_mem_ind_msg_v01 and hence the decoded_size exceeds the wrongly assigend decoded_size. Signed-off-by: Carl Huang --- drivers/net/wireless/ath/ath11k/qmi.c | 8 ++++---- drivers/net/wireless/ath/ath11k/qmi.h | 8 ++++++++ 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c index 5de861e..44060b2 100644 --- a/drivers/net/wireless/ath/ath11k/qmi.c +++ b/drivers/net/wireless/ath/ath11k/qmi.c @@ -2497,21 +2497,21 @@ static const struct qmi_msg_handler ath11k_qmi_msg_handlers[] = { .type = QMI_INDICATION, .msg_id = QMI_WLFW_REQUEST_MEM_IND_V01, .ei = qmi_wlanfw_request_mem_ind_msg_v01_ei, - .decoded_size = sizeof(qmi_wlanfw_request_mem_ind_msg_v01_ei), + .decoded_size = sizeof(struct qmi_wlanfw_request_mem_ind_msg_v01), .fn = ath11k_qmi_msg_mem_request_cb, }, { .type = QMI_INDICATION, .msg_id = QMI_WLFW_FW_MEM_READY_IND_V01, .ei = qmi_wlanfw_mem_ready_ind_msg_v01_ei, - .decoded_size = sizeof(qmi_wlanfw_mem_ready_ind_msg_v01_ei), + .decoded_size = sizeof(struct qmi_wlanfw_fw_mem_ready_ind_msg_v01), .fn = ath11k_qmi_msg_mem_ready_cb, }, { .type = QMI_INDICATION, .msg_id = QMI_WLFW_FW_READY_IND_V01, .ei = qmi_wlanfw_fw_ready_ind_msg_v01_ei, - .decoded_size = sizeof(qmi_wlanfw_fw_ready_ind_msg_v01_ei), + .decoded_size = sizeof(struct qmi_wlanfw_fw_ready_ind_msg_v01), .fn = ath11k_qmi_msg_fw_ready_cb, }, { @@ -2519,7 +2519,7 @@ static const struct qmi_msg_handler ath11k_qmi_msg_handlers[] = { .msg_id = QMI_WLFW_COLD_BOOT_CAL_DONE_IND_V01, .ei = qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei, .decoded_size = - sizeof(qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei), + sizeof(struct qmi_wlanfw_fw_cold_cal_done_ind_msg_v01), .fn = ath11k_qmi_msg_cold_boot_cal_done_cb, }, }; diff --git a/drivers/net/wireless/ath/ath11k/qmi.h b/drivers/net/wireless/ath/ath11k/qmi.h index a1c95b7..6d71895 100644 --- a/drivers/net/wireless/ath/ath11k/qmi.h +++ b/drivers/net/wireless/ath/ath11k/qmi.h @@ -264,6 +264,14 @@ struct qmi_wlanfw_fw_mem_ready_ind_msg_v01 { char placeholder; }; +struct qmi_wlanfw_fw_ready_ind_msg_v01 { + char placeholder; +}; + +struct qmi_wlanfw_fw_cold_cal_done_ind_msg_v01 { + char placeholder; +}; + #define QMI_WLANFW_CAP_REQ_MSG_V01_MAX_LEN 0 #define QMI_WLANFW_CAP_RESP_MSG_V01_MAX_LEN 207 #define QMI_WLANFW_CAP_REQ_V01 0x0024