linux/drivers/net/wireless
Ajay Singh 3ce1c2c399 wifi: wilc1000: use vmm_table as array in wilc struct
commit 05ac1a198a upstream.

Enabling KASAN and running some iperf tests raises some memory issues with
vmm_table:

BUG: KASAN: slab-out-of-bounds in wilc_wlan_handle_txq+0x6ac/0xdb4
Write of size 4 at addr c3a61540 by task wlan0-tx/95

KASAN detects that we are writing data beyond range allocated to vmm_table.
There is indeed a mismatch between the size passed to allocator in
wilc_wlan_init, and the range of possible indexes used later: allocation
size is missing a multiplication by sizeof(u32)

Fixes: 40b717bfce ("wifi: wilc1000: fix DMA on stack objects")
Cc: stable@vger.kernel.org
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231017-wilc1000_tx_oops-v3-1-b2155f1f7bee@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2023-11-28 17:20:02 +00:00
..
admtek wifi: mac80211: add wake_tx_queue callback to drivers 2022-10-10 11:00:03 +02:00
ath wifi: ath12k: fix dfs-radar and temperature event locking 2023-11-28 17:19:59 +00:00
atmel Fix nomenclature for USB and PCI wireless devices 2023-08-25 12:56:49 +03:00
broadcom wifi: brcmfmac: Replace 1-element arrays with flexible arrays 2023-09-18 16:20:21 +03:00
cisco wifi: airo: avoid uninitialized warning in airo_get_rate() 2023-07-11 19:22:54 -07:00
intel wifi: iwlwifi: Use FW rate for non-data frames 2023-11-28 17:19:48 +00:00
intersil Fix nomenclature for USB and PCI wireless devices 2023-08-25 12:56:49 +03:00
legacy Fix nomenclature for USB and PCI wireless devices 2023-08-25 12:56:49 +03:00
marvell wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet 2023-09-18 16:19:25 +03:00
mediatek wifi: mt76: fix clang-specific fortify warnings 2023-11-28 17:19:37 +00:00
microchip wifi: wilc1000: use vmm_table as array in wilc struct 2023-11-28 17:20:02 +00:00
purelifi wifi: plfxlc: fix clang-specific fortify warning 2023-11-28 17:19:36 +00:00
quantenna wifi: qtnfmac: use struct_size and size_sub for payload length 2023-03-13 15:44:29 +02:00
ralink Fix nomenclature for USB and PCI wireless devices 2023-08-25 12:56:49 +03:00
realtek wifi: rtw88: Remove duplicate NULL check before calling usb_kill/free_urb() 2023-11-20 11:59:01 +01:00
rsi wifi: rsi: rsi_91x_usb_ops: Remove unnecessary (void*) conversions 2023-08-23 14:07:16 +03:00
silabs wifi: wfx: fix case where rates are out of order 2023-11-20 11:59:00 +01:00
st net: Replace all spi->chip_select and spi->cs_gpiod references with function call 2023-03-11 12:34:02 +00:00
ti wifi: wlcore: sdio: Use module_sdio_driver macro to simplify the code 2023-08-25 12:59:31 +03:00
virtual wifi: mac80211_hwsim: fix clang-specific fortify warning 2023-11-28 17:19:37 +00:00
zydas Fix nomenclature for USB and PCI wireless devices 2023-08-25 12:56:49 +03:00
Kconfig wifi: move raycs, wl3501 and rndis_wlan to legacy directory 2023-03-13 15:42:14 +02:00
Makefile wifi: move raycs, wl3501 and rndis_wlan to legacy directory 2023-03-13 15:42:14 +02:00