kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/net
History
Tristan Madani 734db72d55 wifi: ath9k: fix OOB access from firmware tx status queue ID 
[ Upstream commit 7ce2f118a2 ]

ath_tx_edma_tasklet() accesses sc->tx.txq[ts.qid] where ts.qid is a
4-bit hardware field (0-15), but the txq array only has
ATH9K_NUM_TX_QUEUES (10) entries. A qid >= 10 causes an OOB array
access.

Add a bounds check on ts.qid before using it as an array index.

Fixes: fce041beb0 ("ath9k: unify edma and non-edma tx code, improve tx fifo handling")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20260415222343.1540564-1-tristmd@gmail.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-07-24 15:51:28 +02:00
..
appletalk make legacy ISA probe optional 2021-08-03 13:05:26 +01:00
arcnet net: arcnet: com20020-pci: fix support for 2.5Mbit cards 2026-04-18 10:33:08 +02:00
bonding net: bonding: fix NULL pointer dereference in bond_do_ioctl() 2026-06-19 13:33:38 +02:00
caif serial: caif: hold tty->link reference in ldisc_open and ser_release 2026-04-18 10:33:12 +02:00
can can: ucan: fix devres lifetime 2026-06-19 13:33:42 +02:00
dsa net: dsa: mt7530: preserve VLAN tags on trapped link-local frames 2026-06-01 17:35:50 +02:00
ethernet net: qualcomm: rmnet: fix endpoint use-after-free in rmnet_dellink() 2026-07-04 13:39:37 +02:00
fddi net: defxx: Fix missing err handling in dfx_init() 2022-12-31 13:14:18 +01:00
fjes fjes: Add missing iounmap in fjes_hw_init() 2026-01-19 13:10:03 +01:00
hamradio net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf 2026-06-01 17:35:29 +02:00
hippi drivers: net: hippi: Fix deadlock in rr_close() 2022-05-09 09:14:40 +02:00
hyperv hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf 2026-06-19 13:33:49 +02:00
ieee802154 ieee802154: ca8210: Use proper setters and getters for bitwise types 2025-06-04 14:37:58 +02:00
ipa net: ipa: compute DMA pool size properly 2023-04-05 11:24:57 +02:00
ipvlan ipvlan: Make the addrs_lock be per port 2026-02-06 16:41:53 +01:00
mctp mctp: Add initial driver infrastructure 2021-07-29 15:06:50 +01:00
mdio net: mdio: aspeed: add dummy read to avoid read-after-write issue 2026-01-19 13:09:56 +01:00
netdevsim netdevsim: zero initialize struct iphdr in dummy sk_buff 2026-06-01 17:35:42 +02:00
pcs net: pcs: xpcs: Return EINVAL in the internal methods 2024-04-13 13:01:43 +02:00
phy phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X 2026-06-19 13:33:25 +02:00
plip net: plip: fix break; causing plip to never transmit 2024-11-01 01:52:36 +01:00
ppp use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
slip slip: bound decode() reads against the compressed packet length 2026-06-01 17:35:39 +02:00
team team: Move team device type change at the end of team_port_add 2026-02-06 16:42:06 +01:00
usb net: usb: kalmia: bound RX frame length in kalmia_rx_fixup() 2026-07-24 15:51:22 +02:00
vmxnet3 vmxnet3: update MTU after device quiesce 2025-09-09 18:50:23 +02:00
vxlan vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() 2026-06-19 13:33:23 +02:00
wan hdlc_ppp: sync per-proto timers before freeing hdlc state 2026-07-04 13:39:39 +02:00
wireguard wireguard: send: append trailer after expanding head 2026-06-19 13:33:27 +02:00
wireless wifi: ath9k: fix OOB access from firmware tx status queue ID 2026-07-24 15:51:28 +02:00
wwan net: wwan: iosm: fix potential memory leaks in ipc_imem_init() 2026-06-01 17:35:46 +02:00
xen-netback xen-netback: reject zero-queue configuration from guest 2026-03-04 07:19:50 -05:00
bareudp.c bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst() 2026-06-01 17:35:43 +02:00
dummy.c net: bonding, dummy, ifb, team: advertise NETIF_F_GSO_SOFTWARE 2020-11-03 16:53:55 -08:00
eql.c eql: use ndo_siocdevprivate 2021-07-27 20:11:43 +01:00
geneve.c geneve: Suppress list corruption splat in geneve_destroy_tunnels(). 2025-03-13 12:50:52 +01:00
gtp.c gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). 2025-03-13 12:50:52 +01:00
ifb.c ifb: fix building without CONFIG_NET_CLS_ACT 2021-11-18 19:16:04 +01:00
Kconfig lib/crypto: blake2s: include as built-in 2022-05-30 09:28:59 +02:00
LICENSE.SRC Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
loopback.c net: loopback: Avoid sending IP packets without an Ethernet header 2025-03-13 12:50:56 +01:00
macsec.c macsec: fix replay protection at XPN lower-PN wrap 2026-06-19 13:33:28 +02:00
macvlan.c macvlan: annotate data-races around port->bc_queue_len_used 2026-06-01 17:35:28 +02:00
macvtap.c macvtap: advertise link netns via netlink 2022-04-13 20:59:07 +02:00
Makefile net: Always descend into dsa/ folder with CONFIG_NET_DSA enabled 2024-06-16 13:39:46 +02:00
mdio.c net: mdio: Correct function name mdio45_links_ok() in comment 2021-03-29 13:42:44 -07:00
mhi_net.c net: mhi: Fix memory leak in mhi_net_dellink() 2022-11-26 09:24:40 +01:00
mii.c net: mii: make mii_ethtool_gset() return void 2021-08-19 13:06:53 +01:00
net_failover.c net/net_failover: fix txq exceeding warning 2023-04-05 11:24:55 +02:00
netconsole.c net: netconsole: Disable target before netpoll cleanup 2024-08-19 05:45:11 +02:00
nlmon.c net: don't include ethtool.h from netdevice.h 2020-11-23 17:27:04 -08:00
ntb_netdev.c ntb_netdev: Use dev_kfree_skb_any() in interrupt context 2022-12-31 13:14:20 +01:00
rionet.c rionet: Fix use correct return type for ndo_start_xmit() 2020-04-30 12:15:13 -07:00
sb1000.c sb1000: use ndo_siocdevprivate 2021-07-27 20:11:44 +01:00
Space.c wan: remove sbni/granch driver 2021-08-03 13:05:26 +01:00
sungem_phy.c net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() 2022-08-03 12:03:48 +02:00
tap.c tap: free page on error paths in tap_get_user_xdp() 2026-06-19 13:33:34 +02:00
thunderbolt.c net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() 2025-08-28 16:24:21 +02:00
tun.c tun: free page on build_skb failure in tun_xdp_one() 2026-06-19 13:33:34 +02:00
veth.c net: veth: do not manipulate GRO when using XDP 2024-03-26 18:21:35 -04:00
virtio_net.c virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false 2026-04-18 10:33:27 +02:00
vrf.c vrf: Fix a potential NPD when removing a port from a VRF 2026-06-01 17:35:42 +02:00
vsockmon.c net: don't include ethtool.h from netdevice.h 2020-11-23 17:27:04 -08:00
xen-netfront.c xen/netfront: Fix TX response spurious interrupts 2025-08-28 16:24:19 +02:00