From patchwork Tue Oct 17 08:43:38 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Alexis_Lothor=C3=A9?= X-Patchwork-Id: 153969 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2908:b0:403:3b70:6f57 with SMTP id ib8csp3984884vqb; Tue, 17 Oct 2023 01:43:02 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGc6tG8COw6OPyRZvxUNRfznCmaSYJadQg+XkqGCC12Monrul/EdeHmbroozhoNQ340cmNL X-Received: by 2002:a05:6a20:ce83:b0:16c:b514:a4bc with SMTP id if3-20020a056a20ce8300b0016cb514a4bcmr1362992pzb.4.1697532181743; Tue, 17 Oct 2023 01:43:01 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1697532181; cv=none; d=google.com; s=arc-20160816; b=fTEaFyhlxS//Revt5mEbNOrohgUI2CpkwRS8WZzFJVK+Bi9F57xw2IwmkSoslmHN68 z9715F2sMnSUJyoO586gJIJLOD1rH7y8P5p0OXP3ev15Lfks/U/2LssIb3vye01l7SJd WboiBvIFTuwi/m+Lygf0bA/TGKa/PuHmGGhYL3xy9BrBszYsAc6lscGlVx4ntta1EfID FdSGnQ+Xk7Pe6Vj28PIau3g7+pMmTYro6fi6CGkHBJrzH2+qj+7WBuZBhSyPPsSh4PcP 4qciqtR9t3uAhXHXa80glpuHiGSkbJp1Mf7VSU8Q2jyBIrkfqlZce9CpPFZkgYPLeOBK 6T4Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=T8KiaMcJZEo5SM/aE3L3QPzs1Td7a+axBBWHqBMtaFc=; fh=t1rw9Z7xIXAb8ZLlESs9c3JBXftINpwm+AHiYFXupaU=; b=vZip2ZB7U78an6tP1GYbTs0ZnUF4yJsZJFvaHOa+9+Kc9afizsRxvZArIsnM7+1sxD dQcN77JmgLH4AEi5RPCkCeawWe9TE7jYMfqBzN28+cUUwaW4kgqXJwK3viBrDQf3NOQe HW1ASRiXJRpghcP8vcD5CZEqm9lP/nlkeAJCrfliUKfEWPg6eG3Idg3pAS44ORw/YMWm hpScYowfPEMl8NQOXKeTITjWtIIYjLTUTSUI6F7+7H2zVD3GdwG/We/R0rlLsFqmYuLg FiYHNXVVsmHhT5DZKBr2Z0kfoLfq9sUVWWziesCHqKSMXbCE2yp2Z3ca2fXbn/gOw5d/ xA8w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@bootlin.com header.s=gm1 header.b="fLDMyF/C"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=bootlin.com Received: from howler.vger.email (howler.vger.email. [23.128.96.34]) by mx.google.com with ESMTPS id f7-20020a17090274c700b001c77916e87dsi1223839plt.591.2023.10.17.01.43.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 17 Oct 2023 01:43:01 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) client-ip=23.128.96.34; Authentication-Results: mx.google.com; dkim=pass header.i=@bootlin.com header.s=gm1 header.b="fLDMyF/C"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.34 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=bootlin.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by howler.vger.email (Postfix) with ESMTP id 6F267803F63D; Tue, 17 Oct 2023 01:42:59 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at howler.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234700AbjJQImm (ORCPT + 19 others); Tue, 17 Oct 2023 04:42:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234620AbjJQIml (ORCPT ); Tue, 17 Oct 2023 04:42:41 -0400 Received: from relay2-d.mail.gandi.net (relay2-d.mail.gandi.net [217.70.183.194]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7BA138E; Tue, 17 Oct 2023 01:42:39 -0700 (PDT) Received: by mail.gandi.net (Postfix) with ESMTPSA id D1ED34000C; Tue, 17 Oct 2023 08:42:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=bootlin.com; s=gm1; t=1697532157; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=T8KiaMcJZEo5SM/aE3L3QPzs1Td7a+axBBWHqBMtaFc=; b=fLDMyF/COl9h5tcNk+O53+KotOZZo+wuyPOozdxKtCAgxy6ltT8xUcdwwwJzC4pMW6JrZ5 cEEI1RQGVKhNdCp0YBIzEFRFINQ64uaL+9opgirQ6/kRlc5uAvmVblyNTCfmb+gNxfjlz8 5WJcALc0LHCXRyrc4Y7lhZ87zasxp82oqkilSPyOvM/X9RqInq0QXzKafzZdkKW6yRyPRN uEBxRimsSW3y+Y9h/4voshcnHmUns95QMOdMO7BH2Q0NvaEnGKNPTp46TJnVH/S/PVN440 9NadwaawP9zWoJ+bOcRVtanZG/6XuE1FDR+WKh+bawwiLQPWkccOBW/hiOz9mA== From: =?utf-8?q?Alexis_Lothor=C3=A9?= Date: Tue, 17 Oct 2023 10:43:38 +0200 Subject: [PATCH v3] wifi: wilc1000: use vmm_table as array in wilc struct MIME-Version: 1.0 Message-Id: <20231017-wilc1000_tx_oops-v3-1-b2155f1f7bee@bootlin.com> X-B4-Tracking: v=1; b=H4sIADlJLmUC/23N0QqCMBTG8VeRXbfY2dJcV71HhOg85gFzsskyx HdvCkFRl/8Pzu/MzKMj9OyUzMxhIE+2j6F2CTNt2d+QUx2bSSEVCJD8QZ0BIUQxToW1g+dpblA DokKtWDwbHDY0beTlGrslP1r33D4EWNc3pn6xABy4OmZQYaVTeajPlbVjR/3e2DtbuSA/iewPI SOR16BzWUqNDXwTy7K8AJqtPgL1AAAA To: Claudiu Beznea , Kalle Valo , Michael Walle Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, Thomas Petazzoni , Ajay Singh , Jeff Johnson , stable@vger.kernel.org, =?utf-8?q?Alexis_Lothor=C3=A9?= X-Mailer: b4 0.12.3 X-GND-Sasl: alexis.lothore@bootlin.com X-Spam-Status: No, score=-0.8 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on howler.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (howler.vger.email [0.0.0.0]); Tue, 17 Oct 2023 01:42:59 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1779628129299737083 X-GMAIL-MSGID: 1779991505035751747 From: Ajay Singh Enabling KASAN and running some iperf tests raises some memory issues with vmm_table: BUG: KASAN: slab-out-of-bounds in wilc_wlan_handle_txq+0x6ac/0xdb4 Write of size 4 at addr c3a61540 by task wlan0-tx/95 KASAN detects that we are writing data beyond range allocated to vmm_table. There is indeed a mismatch between the size passed to allocator in wilc_wlan_init, and the range of possible indexes used later: allocation size is missing a multiplication by sizeof(u32) Fixes: 40b717bfcefa ("wifi: wilc1000: fix DMA on stack objects") Cc: stable@vger.kernel.org Signed-off-by: Ajay Singh Signed-off-by: Alexis Lothoré Reviewed-by: Michael Walle Reviewed-by: Jeff Johnson --- Changes in v3: - Use kcalloc instead of kzalloc - Link to v2: https://lore.kernel.org/r/20231016-wilc1000_tx_oops-v2-1-8d1982a29ef1@bootlin.com Changes in v2: - keep dedicated dynamic allocation for vmm_table - Link to v1: https://lore.kernel.org/r/20231013-wilc1000_tx_oops-v1-1-3761beb9524d@bootlin.com --- drivers/net/wireless/microchip/wilc1000/wlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- base-commit: ea12d85cbfd6b08fff40a4fefccc011b6cfadf8e change-id: 20231012-wilc1000_tx_oops-58ce91ee3e93 Best regards, diff --git a/drivers/net/wireless/microchip/wilc1000/wlan.c b/drivers/net/wireless/microchip/wilc1000/wlan.c index 58bbf50081e4..9eb115c79c90 100644 --- a/drivers/net/wireless/microchip/wilc1000/wlan.c +++ b/drivers/net/wireless/microchip/wilc1000/wlan.c @@ -1492,7 +1492,7 @@ int wilc_wlan_init(struct net_device *dev) } if (!wilc->vmm_table) - wilc->vmm_table = kzalloc(WILC_VMM_TBL_SIZE, GFP_KERNEL); + wilc->vmm_table = kcalloc(WILC_VMM_TBL_SIZE, sizeof(u32), GFP_KERNEL); if (!wilc->vmm_table) { ret = -ENOBUFS;