From patchwork Tue Oct 17 08:43:38 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Alexis_Lothor=C3=A9?= X-Patchwork-Id: 13424797 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BF05C41513 for ; Tue, 17 Oct 2023 08:42:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234674AbjJQImm (ORCPT ); Tue, 17 Oct 2023 04:42:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234620AbjJQIml (ORCPT ); Tue, 17 Oct 2023 04:42:41 -0400 Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [217.70.183.194]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7BA138E; Tue, 17 Oct 2023 01:42:39 -0700 (PDT) Received: by mail.gandi.net (Postfix) with ESMTPSA id D1ED34000C; Tue, 17 Oct 2023 08:42:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1697532157; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T8KiaMcJZEo5SM/aE3L3QPzs1Td7a+axBBWHqBMtaFc=; b=fLDMyF/COl9h5tcNk+O53+KotOZZo+wuyPOozdxKtCAgxy6ltT8xUcdwwwJzC4pMW6JrZ5 cEEI1RQGVKhNdCp0YBIzEFRFINQ64uaL+9opgirQ6/kRlc5uAvmVblyNTCfmb+gNxfjlz8 5WJcALc0LHCXRyrc4Y7lhZ87zasxp82oqkilSPyOvM/X9RqInq0QXzKafzZdkKW6yRyPRN uEBxRimsSW3y+Y9h/4voshcnHmUns95QMOdMO7BH2Q0NvaEnGKNPTp46TJnVH/S/PVN440 9NadwaawP9zWoJ+bOcRVtanZG/6XuE1FDR+WKh+bawwiLQPWkccOBW/hiOz9mA== From: =?utf-8?q?Alexis_Lothor=C3=A9?= Date: Tue, 17 Oct 2023 10:43:38 +0200 Subject: [PATCH v3] wifi: wilc1000: use vmm_table as array in wilc struct MIME-Version: 1.0 Message-Id: <20231017-wilc1000_tx_oops-v3-1-b2155f1f7bee@bootlin.com> X-B4-Tracking: v=1; b=H4sIADlJLmUC/23N0QqCMBTG8VeRXbfY2dJcV71HhOg85gFzsskyx HdvCkFRl/8Pzu/MzKMj9OyUzMxhIE+2j6F2CTNt2d+QUx2bSSEVCJD8QZ0BIUQxToW1g+dpblA DokKtWDwbHDY0beTlGrslP1r33D4EWNc3pn6xABy4OmZQYaVTeajPlbVjR/3e2DtbuSA/iewPI SOR16BzWUqNDXwTy7K8AJqtPgL1AAAA To: Claudiu Beznea , Kalle Valo , Michael Walle Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Petazzoni , Ajay Singh , Jeff Johnson , stable@vger.kernel.org, =?utf-8?q?Alexis_Lothor=C3=A9?= X-Mailer: b4 0.12.3 X-GND-Sasl: alexis.lothore@bootlin.com Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Ajay Singh Enabling KASAN and running some iperf tests raises some memory issues with vmm_table: BUG: KASAN: slab-out-of-bounds in wilc_wlan_handle_txq+0x6ac/0xdb4 Write of size 4 at addr c3a61540 by task wlan0-tx/95 KASAN detects that we are writing data beyond range allocated to vmm_table. There is indeed a mismatch between the size passed to allocator in wilc_wlan_init, and the range of possible indexes used later: allocation size is missing a multiplication by sizeof(u32) Fixes: 40b717bfcefa ("wifi: wilc1000: fix DMA on stack objects") Cc: stable@vger.kernel.org Signed-off-by: Ajay Singh Signed-off-by: Alexis Lothoré Reviewed-by: Michael Walle Reviewed-by: Jeff Johnson --- Changes in v3: - Use kcalloc instead of kzalloc - Link to v2: https://lore.kernel.org/r/20231016-wilc1000_tx_oops-v2-1-8d1982a29ef1@bootlin.com Changes in v2: - keep dedicated dynamic allocation for vmm_table - Link to v1: https://lore.kernel.org/r/20231013-wilc1000_tx_oops-v1-1-3761beb9524d@bootlin.com --- drivers/net/wireless/microchip/wilc1000/wlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- base-commit: ea12d85cbfd6b08fff40a4fefccc011b6cfadf8e change-id: 20231012-wilc1000_tx_oops-58ce91ee3e93 Best regards, diff --git a/drivers/net/wireless/microchip/wilc1000/wlan.c b/drivers/net/wireless/microchip/wilc1000/wlan.c index 58bbf50081e4..9eb115c79c90 100644 --- a/drivers/net/wireless/microchip/wilc1000/wlan.c +++ b/drivers/net/wireless/microchip/wilc1000/wlan.c @@ -1492,7 +1492,7 @@ int wilc_wlan_init(struct net_device *dev) } if (!wilc->vmm_table) - wilc->vmm_table = kzalloc(WILC_VMM_TBL_SIZE, GFP_KERNEL); + wilc->vmm_table = kcalloc(WILC_VMM_TBL_SIZE, sizeof(u32), GFP_KERNEL); if (!wilc->vmm_table) { ret = -ENOBUFS;