From f44dd33e6336294df23ec61f1bbe37a372f5f130 Mon Sep 17 00:00:00 2001 From: Carl Huang Date: Fri, 14 Aug 2020 10:10:27 +0300 Subject: ath11k: fix memory OOB access in qmi_decode The decoded_size is wrongly assigned in ath11k_qmi_msg_handlers and it results in out of boundary access in qmi_decode. The correct decoded_size should be calculated from the related ind_msg structure. This issue is exposed with QCA6390 because it needs 11 small memory chunks which are stored in qmi_wlanfw_request_mem_ind_msg_v01 and hence the decoded_size exceeds the wrongly assigend decoded_size. Tested-on: QCA6390 hw2.0 PCI WLAN.HST.1.0.1-01740-QCAHSTSWPLZ_V2_TO_X86-1 Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.1.0.1-01238-QCAHKSWPL_SILICONZ-2 Signed-off-by: Carl Huang Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/1597389030-13887-9-git-send-email-kvalo@codeaurora.org --- drivers/net/wireless/ath/ath11k/qmi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'drivers/net/wireless/ath/ath11k/qmi.c') diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c index b386ab4bd806..529886b1f068 100644 --- a/drivers/net/wireless/ath/ath11k/qmi.c +++ b/drivers/net/wireless/ath/ath11k/qmi.c @@ -2477,21 +2477,21 @@ static const struct qmi_msg_handler ath11k_qmi_msg_handlers[] = { .type = QMI_INDICATION, .msg_id = QMI_WLFW_REQUEST_MEM_IND_V01, .ei = qmi_wlanfw_request_mem_ind_msg_v01_ei, - .decoded_size = sizeof(qmi_wlanfw_request_mem_ind_msg_v01_ei), + .decoded_size = sizeof(struct qmi_wlanfw_request_mem_ind_msg_v01), .fn = ath11k_qmi_msg_mem_request_cb, }, { .type = QMI_INDICATION, .msg_id = QMI_WLFW_FW_MEM_READY_IND_V01, .ei = qmi_wlanfw_mem_ready_ind_msg_v01_ei, - .decoded_size = sizeof(qmi_wlanfw_mem_ready_ind_msg_v01_ei), + .decoded_size = sizeof(struct qmi_wlanfw_fw_mem_ready_ind_msg_v01), .fn = ath11k_qmi_msg_mem_ready_cb, }, { .type = QMI_INDICATION, .msg_id = QMI_WLFW_FW_READY_IND_V01, .ei = qmi_wlanfw_fw_ready_ind_msg_v01_ei, - .decoded_size = sizeof(qmi_wlanfw_fw_ready_ind_msg_v01_ei), + .decoded_size = sizeof(struct qmi_wlanfw_fw_ready_ind_msg_v01), .fn = ath11k_qmi_msg_fw_ready_cb, }, { @@ -2499,7 +2499,7 @@ static const struct qmi_msg_handler ath11k_qmi_msg_handlers[] = { .msg_id = QMI_WLFW_COLD_BOOT_CAL_DONE_IND_V01, .ei = qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei, .decoded_size = - sizeof(qmi_wlanfw_cold_boot_cal_done_ind_msg_v01_ei), + sizeof(struct qmi_wlanfw_fw_cold_cal_done_ind_msg_v01), .fn = ath11k_qmi_msg_cold_boot_cal_done_cb, }, }; -- cgit v1.2.3