From patchwork Mon Oct 16 08:29:52 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Alexis_Lothor=C3=A9?= X-Patchwork-Id: 13422702 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAAA1C41513 for ; Mon, 16 Oct 2023 08:28:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229848AbjJPI2t (ORCPT ); Mon, 16 Oct 2023 04:28:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229574AbjJPI2s (ORCPT ); Mon, 16 Oct 2023 04:28:48 -0400 Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [IPv6:2001:4b98:dc4:8::222]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D8372A1; Mon, 16 Oct 2023 01:28:45 -0700 (PDT) Received: by mail.gandi.net (Postfix) with ESMTPSA id 0DF594000E; Mon, 16 Oct 2023 08:28:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1697444924; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=SVxISp8EXisyvjENbAcGjSMMTvh4tZlsbQG1yYDAdZ0=; b=BSPXJVwX5YVN5V39vWwzgM8VgRieb1KreLtKFZHvCcHcZQAX74m393ugWyZWSJhPA4z6Ii mjJVi5I2z11VmdhhwjZX/8tUhrYM02lbDkemLGRWm0yk8SiL/4HlYqc++Ec80X6FWL3FS1 HK1VEilQaX0k3PciT650WUqBW5lR6fs/i0HFFx28Gg82QIdA/QRjVHj52ZinkFMgc9O+bk xlV4wcIDQJXISdC9WaVc2JV+9hlRv9kQoI0HK6Jx8nvpv5M8LEmG2+LAumIO2I0R0DFufM i57mWA/9dtul5a9Z2wuFzK2tqLcg2a2HGg/CAXxZdWmtPpzh+R6Y3FBpugxHnA== From: =?utf-8?q?Alexis_Lothor=C3=A9?= Date: Mon, 16 Oct 2023 10:29:52 +0200 Subject: [PATCH v2] wifi: wilc1000: use vmm_table as array in wilc struct MIME-Version: 1.0 Message-Id: <20231016-wilc1000_tx_oops-v2-1-8d1982a29ef1@bootlin.com> X-B4-Tracking: v=1; b=H4sIAH/0LGUC/2WNQQ6CMBBFr0JmbU2nFRVW3sMQImWUSbBDWoIYw t2tJK5cvpf89xeIFJgilNkCgSaOLD6B2WXgupt/kOI2MRhtLGo06sW9Q611Pc61yBBVfnZUIJG lwkKaDYHuPG/Ja5W44zhKeG8PE37tL2b/YxMqVPZ0xIaaIjeH9tKIjD37vZMnVOu6fgBHdRWEs gAAAA== To: Claudiu Beznea , Kalle Valo , Michael Walle Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Petazzoni , Ajay Singh , stable@vger.kernel.org, =?utf-8?q?A?= =?utf-8?q?lexis_Lothor=C3=A9?= X-Mailer: b4 0.12.3 X-GND-Sasl: alexis.lothore@bootlin.com Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org From: Ajay Singh Enabling KASAN and running some iperf tests raises some memory issues with vmm_table: BUG: KASAN: slab-out-of-bounds in wilc_wlan_handle_txq+0x6ac/0xdb4 Write of size 4 at addr c3a61540 by task wlan0-tx/95 KASAN detects that we are writing data beyond range allocated to vmm_table. There is indeed a mismatch between the size passed to allocator in wilc_wlan_init, and the range of possible indexes used later: allocation size is missing a multiplication by sizeof(u32) Fixes: 40b717bfcefa ("wifi: wilc1000: fix DMA on stack objects") Cc: stable@vger.kernel.org Signed-off-by: Ajay Singh Signed-off-by: Alexis Lothoré Reviewed-by: Michael Walle --- Changes in v2: - keep dedicated dynamic allocation for vmm_table - Link to v1: https://lore.kernel.org/r/20231013-wilc1000_tx_oops-v1-1-3761beb9524d@bootlin.com --- drivers/net/wireless/microchip/wilc1000/wlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- base-commit: ea12d85cbfd6b08fff40a4fefccc011b6cfadf8e change-id: 20231012-wilc1000_tx_oops-58ce91ee3e93 Best regards, diff --git a/drivers/net/wireless/microchip/wilc1000/wlan.c b/drivers/net/wireless/microchip/wilc1000/wlan.c index 58bbf50081e4..e4113f2dfadf 100644 --- a/drivers/net/wireless/microchip/wilc1000/wlan.c +++ b/drivers/net/wireless/microchip/wilc1000/wlan.c @@ -1492,7 +1492,7 @@ int wilc_wlan_init(struct net_device *dev) } if (!wilc->vmm_table) - wilc->vmm_table = kzalloc(WILC_VMM_TBL_SIZE, GFP_KERNEL); + wilc->vmm_table = kzalloc(WILC_VMM_TBL_SIZE * sizeof(u32), GFP_KERNEL); if (!wilc->vmm_table) { ret = -ENOBUFS;