| Message ID | 20221017114304.4030248-1-yajun.deng@linux.dev (mailing list archive) |
|---|---|
| State | Awaiting Upstream |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | iwlwifi: mvm: fix shift-out-of-bounds in iwl_mvm_add_aux_sta() | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c index cbd8053a9e35..33e2757e6fe6 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c @@ -2088,12 +2088,14 @@ static int iwl_mvm_add_int_sta_with_queue(struct iwl_mvm *mvm, int macidx, int iwl_mvm_add_aux_sta(struct iwl_mvm *mvm, u32 lmac_id) { + u32 qmask; int ret; lockdep_assert_held(&mvm->mutex); + qmask = iwl_mvm_has_new_tx_api(mvm) ? 0 : BIT(mvm->aux_queue); /* Allocate aux station and assign to it the aux queue */ - ret = iwl_mvm_allocate_int_sta(mvm, &mvm->aux_sta, BIT(mvm->aux_queue), + ret = iwl_mvm_allocate_int_sta(mvm, &mvm->aux_sta, qmask, NL80211_IFTYPE_UNSPECIFIED, IWL_STA_AUX_ACTIVITY); if (ret)
There is a warning when mvm->aux_queue is equal to IWL_MVM_INVALID_QUEUE: [ 5.225765] ================================================================================ [ 5.225770] UBSAN: shift-out-of-bounds in drivers/net/wireless/intel/iwlwifi/mvm/sta.c:2096:53 [ 5.225773] shift exponent 65535 is too large for 64-bit type 'long unsigned int' [ 5.225777] Call Trace: [ 5.225779] <TASK> [ 5.225781] dump_stack_lvl+0x4a/0x5f [ 5.225785] dump_stack+0x10/0x12 [ 5.225786] ubsan_epilogue+0x9/0x45 [ 5.225787] __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e [ 5.225790] iwl_mvm_add_aux_sta.cold+0x17/0x1f [iwlmvm] [ 5.225804] iwl_mvm_up+0x76c/0xb90 [iwlmvm] [ 5.225814] __iwl_mvm_mac_start+0x2b/0x190 [iwlmvm] [ 5.225821] iwl_mvm_mac_start+0x5f/0xc0 [iwlmvm] ... [ 5.225952] ? _copy_from_user+0x2b/0x60 [ 5.225979] __x64_sys_sendmsg+0x1f/0x30 [ 5.225980] do_syscall_64+0x59/0xc0 [ 5.225982] ? syscall_exit_to_user_mode+0x27/0x50 [ 5.225984] ? __x64_sys_write+0x1a/0x20 [ 5.225985] ? do_syscall_64+0x69/0xc0 [ 5.225986] ? __x64_sys_write+0x1a/0x20 [ 5.225987] ? do_syscall_64+0x69/0xc0 [ 5.225988] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 5.225990] RIP: 0033:0x7fa42e00b18d [ 5.225993] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48 [ 5.225994] RSP: 002b:00007fffba9a21c0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e [ 5.225996] RAX: ffffffffffffffda RBX: 0000562bdc028880 RCX: 00007fa42e00b18d [ 5.225996] RDX: 0000000000000000 RSI: 00007fffba9a2210 RDI: 000000000000000c [ 5.225997] RBP: 00007fffba9a2210 R08: 0000000000000000 R09: 0000000000000000 [ 5.225998] R10: 0000562bdbffa010 R11: 0000000000000293 R12: 0000562bdc028880 [ 5.225998] R13: 00007fffba9a23c8 R14: 00007fffba9a23bc R15: 0000000000000000 [ 5.225999] </TASK> [ 5.226004] ================================================================================ mvm->aux_queue may be assigned IWL_MVM_INVALID_QUEUE in iwl_op_mode_mvm_start(). Add iwl_mvm_has_new_tx_api() before iwl_mvm_allocate_int_sta() to avoid shift-out-of-bounds. Fixes: c6ce1c74ef29 ("iwlwifi: mvm: avoid static queue number aliasing") Signed-off-by: Yajun Deng <yajun.deng@linux.dev> --- drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)