]> git.baikalelectronics.ru Git - kernel.git/commit
ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
authorDan Carpenter <dan.carpenter@oracle.com>
Sat, 9 Apr 2022 06:12:25 +0000 (09:12 +0300)
committerKalle Valo <quic_kvalo@quicinc.com>
Sat, 23 Apr 2022 09:32:18 +0000 (12:32 +0300)
commit0f933f70b27f9e076157915b97a131e29591c854
tree2920a8d20cea81d003ee55de7a3458bc2faf7ef9
parent77bcba4d4870c44aecc12d27036eef1df92c3eb9
ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix

The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to
ensure that it is within the bitmap.

drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept()
error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()'

Fixes: 7e90db24d5ee ("ath9k_htc: use ath9k_cmn_rx_accept")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20220409061225.GA5447@kili
drivers/net/wireless/ath/ath9k/htc_drv_txrx.c