From patchwork Thu Jun 20 18:56:13 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Karthikeyan periyasamy X-Patchwork-Id: 11007773 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 96E191398 for ; Thu, 20 Jun 2019 18:56:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 885C828783 for ; Thu, 20 Jun 2019 18:56:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7C09328846; Thu, 20 Jun 2019 18:56:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 35BD528783 for ; Thu, 20 Jun 2019 18:56:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=zgi71K+0yDJqf1wBNVfWLMuSjIDMN72P1hziKmg5Ee0=; b=iVT 5RmplmW8429hTkihRwI+WwqWVFrHhGK3A+kS+hEmHyFjrHHYOAQ6507fnUlyPJdRY5f1WYcXn+IIK xF7bJhJgpKjPfoFn5EOfwxtUHmjomuRgCHcxgP8YZigWxzYHHpco1ENg0+u6yapA6UfhVTAdtAb2w mMB4jiuY6h7YuPUwDfog1oOT0W6my82ZSS+i1T1pQMoFcB5mg7Xthw21iM6d48HW4EzVXwtb4zdSK DlaufBv5N8RT5ki+/u0LCjmp/VsTKD/Aq4UHyWdYZZMuF63kT0kjYxdRfZJHRTOqbG1gvxxVXTo0I +0L9xiT3WRV2YsgOfx2aLM/tvwUFH+w==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92 #3 (Red Hat Linux)) id 1he2El-0003Fx-3o; Thu, 20 Jun 2019 18:56:43 +0000 Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1he2Eh-0003FD-My for ath11k@lists.infradead.org; Thu, 20 Jun 2019 18:56:41 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id EA11060A97; Thu, 20 Jun 2019 18:56:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1561056995; bh=taWotqX3xyx7yjw2A79wnAyHQgpOHcQClVq+0X1Ckmk=; h=From:To:Cc:Subject:Date:From; b=DjXALncdgmeiqRALJBQnF+fqAhGM3IPPaGagQwXw9GPxlPtmv88ltoyICTZ1Equo1 KAjZ308VJGXgS68MaLKXX0DmKOvvwdYYatKeAQyu8Vt0F+nFtevmF152miWSFpx+T9 DUTDgGTqHYxuD29uNBKhuBUQmdhET4CAC+CmnLZg= Received: from CHECSTP284781-LIN.qualcomm.com (blr-c-bdr-fw-01_globalnat_allzones-outside.qualcomm.com [103.229.19.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: periyasa@codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 7949E60A43; Thu, 20 Jun 2019 18:56:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1561056995; bh=taWotqX3xyx7yjw2A79wnAyHQgpOHcQClVq+0X1Ckmk=; h=From:To:Cc:Subject:Date:From; b=DjXALncdgmeiqRALJBQnF+fqAhGM3IPPaGagQwXw9GPxlPtmv88ltoyICTZ1Equo1 KAjZ308VJGXgS68MaLKXX0DmKOvvwdYYatKeAQyu8Vt0F+nFtevmF152miWSFpx+T9 DUTDgGTqHYxuD29uNBKhuBUQmdhET4CAC+CmnLZg= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 7949E60A43 Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=periyasa@codeaurora.org From: Karthikeyan Periyasamy To: ath11k@lists.infradead.org Subject: [PATCH] ath11k: fix invalid memory access Date: Fri, 21 Jun 2019 00:26:13 +0530 Message-Id: <1561056973-32524-1-git-send-email-periyasa@codeaurora.org> X-Mailer: git-send-email 1.9.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190620_115640_567994_746E00D2 X-CRM114-Status: GOOD ( 10.86 ) X-BeenThere: ath11k@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Karthikeyan Periyasamy MIME-Version: 1.0 Sender: "ath11k" Errors-To: ath11k-bounces+patchwork-ath11k=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP dp_reo_cache_flush_elem element get dynamically allocated with invalid size which leads to the access of unallocated memory region or memory corruption. Fix this bug by allocate with dp_reo_cache_flush_elem structure size. Signed-off-by: Karthikeyan Periyasamy --- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index 7654f9a..c64beb5 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -568,7 +568,7 @@ static void ath11k_dp_rx_tid_del_func(struct ath11k_dp *dp, void *ctx, return; } - elem = kzalloc(sizeof(elem), GFP_ATOMIC); + elem = kzalloc(sizeof(*elem), GFP_ATOMIC); if (!elem) { ath11k_warn(ab, "failed to allocate memory for cache flush element\n"); goto free_desc;