From patchwork Mon Feb 5 22:38:51 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mike Lothian X-Patchwork-Id: 10201947 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id B5EAD602CA for ; Mon, 5 Feb 2018 22:39:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 90C39285C9 for ; Mon, 5 Feb 2018 22:39:16 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8314828841; Mon, 5 Feb 2018 22:39:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9BBBE285C9 for ; Mon, 5 Feb 2018 22:39:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751624AbeBEWjO (ORCPT ); Mon, 5 Feb 2018 17:39:14 -0500 Received: from mail-qt0-f171.google.com ([209.85.216.171]:35505 "EHLO mail-qt0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750796AbeBEWjN (ORCPT ); Mon, 5 Feb 2018 17:39:13 -0500 Received: by mail-qt0-f171.google.com with SMTP id g14so41779106qti.2 for ; Mon, 05 Feb 2018 14:39:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=fireburn-co-uk.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=hPL3gEC/oVWGmIO3i+TBXVm9fpEeeA+pacOp+0VSwes=; b=ptrU1clpupXJy+Qa/6XEgOV2PohJU6BxJ41GpNUigRl+n9mde4Z4CNQgPg7M+PKpDJ 0KDAa3x+FYxi4c/EdTOLK7t5vB5Fstudp7WKG+EIvOlZC3Al4OVeRUbHfhxQmYtKsuAb rD96S9c/Q5UDicv1Be5ZMC1pQOAE+4BgUlCTGbOvx9MMhxc+Tf5wfox6MPNGrYvp9Pna +PEuK8vM0vHUWCPKIPeiylbooUvPUpZViCUjcYWBjfVu/BDOO8XQqsKj5x8QtFXp9We3 xCyNEbIMSc6IW5ZzDdz7A/KbTxZ7IlxuNx8wh1VvKmxJuBOh/tnlrmKIhw748YdleXKL eHVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=hPL3gEC/oVWGmIO3i+TBXVm9fpEeeA+pacOp+0VSwes=; b=fAFOY2dtpRp1ycoCH/PbrRZ8dksb7WA5/RxatGLVnMxgdJpCi+MlvBnzGyCLJvRjWz boNX1Dh8wiUiIVrcUharDdNemLmmGCz/qmC4iVMLrxIfJQ0M395NQp1GEJU+R07k9Yh8 Sv6htBFTjRxfhDAmR5Hwx75NL0NOprljlW5am7lLdb7s016MDCggPGSc03pDY46gcZeI 5JnTjmY/ULEtdr53GVjWivWoXLtzX77J3EMvpfneLT9WwGxvLJnS35NEnH/f2AT/7eeg CJPM74zYpj8wJGJT8yFn2KvXlIfINw7QYztJk5qbuP1/R5/ahBl/XzicXkXZ+Ax/bVuH FK0A== X-Gm-Message-State: APf1xPCt1hDlW895zemyZQ21ocdEwC3O47/gQ2SB0lFRGLYHl5m4oyOF TCNZmhwCfbDQiOGnjG+fn/YxovbCixIYdBCXUIp0qJK8w+g= X-Google-Smtp-Source: AH8x227oh4ARvNvLWHNt6ptnj8MlILgKdJ6JotSKb6BVcEkFKsrTrkyOXvGU32qgDl6NjQsMsyHo3wuPB1koBJ9VaXw= X-Received: by 10.200.6.65 with SMTP id e1mr605884qth.101.1517870352239; Mon, 05 Feb 2018 14:39:12 -0800 (PST) MIME-Version: 1.0 Received: by 10.12.214.81 with HTTP; Mon, 5 Feb 2018 14:38:51 -0800 (PST) From: Mike Lothian Date: Mon, 5 Feb 2018 22:38:51 +0000 Message-ID: Subject: Regression in ath10k To: linux-wireless@vger.kernel.org, yanhsu@codeaurora.org, valo@codeaurora.org Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hi Since the merge window opened I've been unable to see any wireless networks or join my usual access point I bisected this to: 9ed4f91628737c820af6a1815b65bc06bd31518f is the first bad commit commit 9ed4f91628737c820af6a1815b65bc06bd31518f Author: Ryan Hsu Date: Tue Jan 16 11:43:49 2018 +0200 ath10k: add sanity check to ie_len before parsing fw/board ie Validate ie_len after the alignment padding before access the buffer to avoid potential overflow. Signed-off-by: Ryan Hsu Signed-off-by: Kalle Valo And I can confirm that reverting the patch makes things work again (attached) Device: 3c:00.0 Network controller [0280]: Qualcomm Atheros QCA6174 802.11ac Wireless Network Adapter [168c:003e] (rev 32) Firmware: https://github.com/kvalo/ath10k-firmware ath10k-firmware/QCA6174/hw3.0/4.4.1.c1 There was nothing obvious in the dmesg Regards Mike commit 95f211b87b23a2586ea5cb01f61e8f7945b7804e Author: Mike Lothian Date: Mon Feb 5 22:16:41 2018 +0000 Revert "ath10k: add sanity check to ie_len before parsing fw/board ie" This reverts commit 9ed4f91628737c820af6a1815b65bc06bd31518f. diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c index b0fdc1023619..e89a7846dddb 100644 --- a/drivers/net/wireless/ath/ath10k/core.c +++ b/drivers/net/wireless/ath/ath10k/core.c @@ -1276,10 +1276,7 @@ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar, len -= sizeof(*hdr); data = hdr->data; - /* jump over the padding */ - ie_len = ALIGN(ie_len, 4); - - if (len < ie_len) { + if (len < ALIGN(ie_len, 4)) { ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n", ie_id, ie_len, len); ret = -EINVAL; @@ -1318,6 +1315,8 @@ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar, goto out; } + /* jump over the padding */ + ie_len = ALIGN(ie_len, 4); len -= ie_len; data += ie_len; } @@ -1448,9 +1447,6 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name, len -= sizeof(*hdr); data += sizeof(*hdr); - /* jump over the padding */ - ie_len = ALIGN(ie_len, 4); - if (len < ie_len) { ath10k_err(ar, "invalid length for FW IE %d (%zu < %zu)\n", ie_id, len, ie_len); @@ -1556,6 +1552,9 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name, break; } + /* jump over the padding */ + ie_len = ALIGN(ie_len, 4); + len -= ie_len; data += ie_len; }