iwlwifi: mvm: d3: Fix off by ones in iwl_mvm_wowlan_get_rsc_v5_data()
Subsystems (2)
PATCH 1/2 iwlwifi: mvm: d3: Fix off by ones in iwl_mvm_wowlan_get_rsc_v5_data()
These should be >= ARRAY_SIZE() instead of > ARRAY_SIZE() to prevent an out of bounds write on the next line.
--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +2 -2
@@ -360,11 +360,11 @@ static void iwl_mvm_wowlan_get_rsc_v5_data(struct ieee80211_hw *hw,if (sta) { rsc = data->rsc->ucast_rsc; }else { -if (WARN_ON (data->gtks >ARRAY_SIZE (data->gtk_ids))) +if (WARN_ON (data->gtks >=ARRAY_SIZE (data->gtk_ids)))return ; data->gtk_ids[data->gtks] = key->keyidx; rsc = data->rsc->mcast_rsc[data->gtks %2 ]; -if (WARN_ON (key->keyidx > +if (WARN_ON (key->keyidx >=ARRAY_SIZE (data->rsc->mcast_key_id_map)))return ; data->rsc->mcast_key_id_map[key->keyidx] = data->gtks %2 ;
Signature · 1 line
2.20.1
PATCH 2/2 iwlwifi: mvm: d3: missing unlock in iwl_mvm_wowlan_program_keys()
This code was refactored and the mutex_unlock(&mvm->mutex); was accidentally deleted.
--- drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +1 -0
@@ -160,6 +160,7 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw, mvm->ptk_icvlen = key->icv_len; mvm->gtk_ivlen = key->iv_len; mvm->gtk_icvlen = key->icv_len; +mutex_unlock (&mvm->mutex);/* don't upload key again */ return ;
Signature · 1 line
2.20.1
Re: [PATCH 2/2] iwlwifi: mvm: d3: missing unlock in iwl_mvm_wowlan_program_keys()
Quoted 20 lines · Dan Carpenter
This code was refactored and the
mutex_unlock(&mvm->mutex); was accidentally deleted.Fixes af3aab9ce298 ("iwlwifi: mvm: d3: make key reprogramming iteration optional")Signed-off-by Dan Carpenter <[email protected]>---
drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 1 +1 file changed, 1 insertion(+)drivers/net/wireless/intel/iwlwifi/mvm/d3.c +1
-0@@ -160,6 +160,7 @@ static void iwl_mvm_wowlan_program_keys(struct ieee80211_hw *hw, mvm->ptk_icvlen = key->icv_len; mvm->gtk_ivlen = key->iv_len; mvm->gtk_icvlen = key->icv_len; +mutex_unlock (&mvm->mutex);
Quoted 2 lines
/* don't upload key again */
return;
Thank you, Dan!
--
Cheers,
Luca.
Quoted 5 lines · Dan Carpenter
These should be >=
ARRAY_SIZE()instead of >ARRAY_SIZE()to prevent an out of bounds write on the next line.Fixes 79e561f0f05a ("iwlwifi: mvm: d3: implement RSC command version 5")Signed-off-by Dan Carpenter <[email protected]>
I think I should take both patches to v5.15. Luca, do you agree? Ack?
I assigned these to me on patchwork.
Signature · 3 lines
https://patchwork.kernel.org/project/linux-wireless/list/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
Quoted 11 lines · Kalle Valo
Quoted 5 lines · Dan Carpenter
These should be >=
ARRAY_SIZE()instead of >ARRAY_SIZE()to prevent an out of bounds write on the next line.Fixes 79e561f0f05a ("iwlwifi: mvm: d3: implement RSC command version 5")Signed-off-by Dan Carpenter <[email protected]>I think I should take both patches to v5.15. Luca, do you agree? Ack?
I assigned these to me on patchwork.
Yes, please take them, thanks!
--
Cheers,
Luca.
Quoted 17 lines · Dan Carpenter
These should be >=
ARRAY_SIZE()instead of >ARRAY_SIZE()to prevent an out of bounds write on the next line.Fixes 79e561f0f05a ("iwlwifi: mvm: d3: implement RSC command version 5")Signed-off-by Dan Carpenter <[email protected]>---
drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 4 ++--1 file changed, 2 insertions(+), 2 deletions(-)drivers/net/wireless/intel/iwlwifi/mvm/d3.c +0
-0@@ -360,11 +360,11 @@ static void iwl_mvm_wowlan_get_rsc_v5_data(struct ieee80211_hw *hw, if (sta) { rsc = data->rsc->ucast_rsc; } else {
drivers/net/wireless/intel/iwlwifi/mvm/d3.c static void iwl_mvm_wowlan_get_rsc_v5_data(struct ieee80211_hw *hw, · line 370
Quoted 10 lines
drivers/net/wireless/intel/iwlwifi/mvm/d3.c +2
-2-if (WARN_ON (data->gtks >ARRAY_SIZE (data->gtk_ids))) +if (WARN_ON (data->gtks >=ARRAY_SIZE (data->gtk_ids))) return; data->gtk_ids[data->gtks] = key->keyidx; rsc = data->rsc->mcast_rsc[data->gtks % 2]; -if (WARN_ON (key->keyidx > +if (WARN_ON (key->keyidx >= ARRAY_SIZE(data->rsc->mcast_key_id_map))) return; data->rsc->mcast_key_id_map[key->keyidx] = data->gtks % 2;
Thanks!
--
Cheers,
Luca.
Quoted 6 lines · Dan Carpenter
These should be >=
ARRAY_SIZE()instead of >ARRAY_SIZE()to prevent an out of bounds write on the next line.Fixes 79e561f0f05a ("iwlwifi: mvm: d3: implement RSC command version 5")Signed-off-by Dan Carpenter <[email protected]>Acked-by Luca Coelho <[email protected]>
2 patches applied to wireless-drivers.git, thanks.
27a221f433b7 iwlwifi: mvm: d3: Fix off by ones in iwl_mvm_wowlan_get_rsc_v5_data() b6a46b4f6e4b iwlwifi: mvm: d3: missing unlock in iwl_mvm_wowlan_program_keys()
Signature · 3 lines
https://patchwork.kernel.org/project/linux-wireless/patch/20210831081802.GA9846@kili/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches