| Message ID | 20250424185244.3562-1-a.safin@rosa.ru |
|---|---|
| State | Superseded |
| Headers | show |
| Series | [v2] iwlegacy: 4965: fix possible out-of-bounds access in il4965_tx_cmd_build_rate() | expand |
Alexei Safin <a.safin@rosa.ru> wrote: > > Prevent out-of-bounds access in il4965_tx_cmd_build_rate() by rejecting > rate_idx values greater than or equal to RATE_COUNT_LEGACY. > > Use a correct bounds check to avoid accessing il_rates[] with > an invalid index. The previous comparison allowed rate_idx to become > equal to RATE_COUNT_LEGACY, which exceeds the array limit. > > Replace the check 'rate_idx > RATE_COUNT_LEGACY' with > 'rate_idx >= RATE_COUNT_LEGACY' to ensure memory safety. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: 7ac9a364c172 ("iwlegacy: move under intel directory") The Fixes is obviously wrong. It just moved the code. > Signed-off-by: Alexei Safin <a.safin@rosa.ru> > --- > v2: change reciepent > drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c > b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > index 78dee8ccfebf..f60d9b9798c1 100644 > --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c > +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > @@ -1572,7 +1572,7 @@ il4965_tx_cmd_build_rate(struct il_priv *il, > */ > rate_idx = info->control.rates[0].idx; > if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0 > - || rate_idx > RATE_COUNT_LEGACY) > + || rate_idx >= RATE_COUNT_LEGACY) > rate_idx = rate_lowest_index(&il->bands[info->band], sta); > /* For 5 GHZ band, remap mac80211 rate indices into driver indices */ > if (info->band == NL80211_BAND_5GHZ) > -- > 2.39.5 (Apple Git-154) >
Hi On Thu, Apr 24, 2025 at 09:52:44PM +0300, Alexei Safin wrote: > Prevent out-of-bounds access in il4965_tx_cmd_build_rate() by rejecting > rate_idx values greater than or equal to RATE_COUNT_LEGACY. > > Use a correct bounds check to avoid accessing il_rates[] with > an invalid index. The previous comparison allowed rate_idx to become > equal to RATE_COUNT_LEGACY, which exceeds the array limit. Thanks for the patch, however I think it's not correct. The definitions are: enum { RATE_1M_IDX = 0, ... RATE_54M_INDEX, RATE_60M_INDEX, RATE_COUNT RATE_COUNT_LEGACY = RATE_COUNT - 1, /* Excluding 60M */ } extern const struct il_rate_info il_rates[RATE_COUNT]; > Replace the check 'rate_idx > RATE_COUNT_LEGACY' with > 'rate_idx >= RATE_COUNT_LEGACY' to ensure memory safety. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > Fixes: 7ac9a364c172 ("iwlegacy: move under intel directory") > Signed-off-by: Alexei Safin <a.safin@rosa.ru> > --- > v2: change reciepent > drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > index 78dee8ccfebf..f60d9b9798c1 100644 > --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c > +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > @@ -1572,7 +1572,7 @@ il4965_tx_cmd_build_rate(struct il_priv *il, > */ > rate_idx = info->control.rates[0].idx; > if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0 > - || rate_idx > RATE_COUNT_LEGACY) > + || rate_idx >= RATE_COUNT_LEGACY) > rate_idx = rate_lowest_index(&il->bands[info->band], sta); .. so looks the check is fine already and changing it will induce a bug for RATE_54M_INDEX. Regards Stanislaw > /* For 5 GHZ band, remap mac80211 rate indices into driver indices */ > if (info->band == NL80211_BAND_5GHZ) > -- > 2.39.5 (Apple Git-154) >
Hello, On Sun, 27. Apr 08:39, Stanislaw Gruszka wrote: > > diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > > index 78dee8ccfebf..f60d9b9798c1 100644 > > --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c > > +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > > @@ -1572,7 +1572,7 @@ il4965_tx_cmd_build_rate(struct il_priv *il, > > */ > > rate_idx = info->control.rates[0].idx; > > if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0 > > - || rate_idx > RATE_COUNT_LEGACY) > > + || rate_idx >= RATE_COUNT_LEGACY) > > rate_idx = rate_lowest_index(&il->bands[info->band], sta); > > .. so looks the check is fine already and changing it will induce a bug > for RATE_54M_INDEX. > > Regards > Stanislaw > > > /* For 5 GHZ band, remap mac80211 rate indices into driver indices */ > > if (info->band == NL80211_BAND_5GHZ) Here goes the fragment: rate_idx += IL_FIRST_OFDM_RATE; /* Get PLCP rate for tx_cmd->rate_n_flags */ rate_plcp = il_rates[rate_idx].plcp; > > -- > > 2.39.5 (Apple Git-154) > > Looks like the proper checks should be added to address the 5GHZ case and validate that the index won't exceed the array boundaries after being shifted by IL_FIRST_OFDM_RATE. -- Thanks, Fedor
Hi On Tue, Apr 29, 2025 at 08:15:59PM +0300, Fedor Pchelkin wrote: > Hello, > > On Sun, 27. Apr 08:39, Stanislaw Gruszka wrote: > > > diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > > > index 78dee8ccfebf..f60d9b9798c1 100644 > > > --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c > > > +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c > > > @@ -1572,7 +1572,7 @@ il4965_tx_cmd_build_rate(struct il_priv *il, > > > */ > > > rate_idx = info->control.rates[0].idx; > > > if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0 > > > - || rate_idx > RATE_COUNT_LEGACY) > > > + || rate_idx >= RATE_COUNT_LEGACY) > > > rate_idx = rate_lowest_index(&il->bands[info->band], sta); > > > > .. so looks the check is fine already and changing it will induce a bug > > for RATE_54M_INDEX. > > > > Regards > > Stanislaw > > > > > /* For 5 GHZ band, remap mac80211 rate indices into driver indices */ > > > if (info->band == NL80211_BAND_5GHZ) > > Here goes the fragment: > > rate_idx += IL_FIRST_OFDM_RATE; > /* Get PLCP rate for tx_cmd->rate_n_flags */ > rate_plcp = il_rates[rate_idx].plcp; > > > > -- > > > 2.39.5 (Apple Git-154) > > > > > Looks like the proper checks should be added to address the 5GHZ case and > validate that the index won't exceed the array boundaries after being shifted > by IL_FIRST_OFDM_RATE. Good point. It make sense to move rate_idx range check after possible IL_FIRST_OFDM_RATE addition for 5GHz. Regards Stanislaw
diff --git a/drivers/net/wireless/intel/iwlegacy/4965-mac.c b/drivers/net/wireless/intel/iwlegacy/4965-mac.c index 78dee8ccfebf..f60d9b9798c1 100644 --- a/drivers/net/wireless/intel/iwlegacy/4965-mac.c +++ b/drivers/net/wireless/intel/iwlegacy/4965-mac.c @@ -1572,7 +1572,7 @@ il4965_tx_cmd_build_rate(struct il_priv *il, */ rate_idx = info->control.rates[0].idx; if ((info->control.rates[0].flags & IEEE80211_TX_RC_MCS) || rate_idx < 0 - || rate_idx > RATE_COUNT_LEGACY) + || rate_idx >= RATE_COUNT_LEGACY) rate_idx = rate_lowest_index(&il->bands[info->band], sta); /* For 5 GHZ band, remap mac80211 rate indices into driver indices */ if (info->band == NL80211_BAND_5GHZ)
Prevent out-of-bounds access in il4965_tx_cmd_build_rate() by rejecting rate_idx values greater than or equal to RATE_COUNT_LEGACY. Use a correct bounds check to avoid accessing il_rates[] with an invalid index. The previous comparison allowed rate_idx to become equal to RATE_COUNT_LEGACY, which exceeds the array limit. Replace the check 'rate_idx > RATE_COUNT_LEGACY' with 'rate_idx >= RATE_COUNT_LEGACY' to ensure memory safety. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7ac9a364c172 ("iwlegacy: move under intel directory") Signed-off-by: Alexei Safin <a.safin@rosa.ru> --- v2: change reciepent drivers/net/wireless/intel/iwlegacy/4965-mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)