linux-imx/drivers/net
Ajay Singh 3ce1c2c399 wifi: wilc1000: use vmm_table as array in wilc struct
commit 05ac1a198a upstream.

Enabling KASAN and running some iperf tests raises some memory issues with
vmm_table:

BUG: KASAN: slab-out-of-bounds in wilc_wlan_handle_txq+0x6ac/0xdb4
Write of size 4 at addr c3a61540 by task wlan0-tx/95

KASAN detects that we are writing data beyond range allocated to vmm_table.
There is indeed a mismatch between the size passed to allocator in
wilc_wlan_init, and the range of possible indexes used later: allocation
size is missing a multiplication by sizeof(u32)

Fixes: 40b717bfce ("wifi: wilc1000: fix DMA on stack objects")
Cc: stable@vger.kernel.org
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231017-wilc1000_tx_oops-v3-1-b2155f1f7bee@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-11-28 17:20:02 +00:00
..
appletalk
arcnet net: arcnet: Do not call kfree_skb() under local_irq_disable() 2023-08-25 10:10:52 +01:00
bonding bonding: stop the device in bond_setup_by_slave() 2023-11-28 17:19:51 +00:00
caif
can can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds 2023-11-20 11:59:00 +01:00
dsa net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() 2023-10-13 16:29:46 -07:00
ethernet net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors 2023-11-28 17:19:53 +00:00
fddi
fjes
hamradio
hippi
hyperv
ieee802154 net: ieee802154: adf7242: Fix some potential buffer overflow in adf7242_stats_show() 2023-10-22 11:28:43 +01:00
ipa ARM: SoC drivers for 6.6 2023-08-30 16:42:21 -07:00
ipvlan ipvlan: add ipvlan_route_v6_outbound() helper 2023-11-28 17:19:50 +00:00
mctp
mdio net: mdio-mux: fix C45 access returning -EIO after API change 2023-10-18 18:08:23 -07:00
netdevsim
pcs net: pcs: xpcs: adapt Wangxun NICs for SGMII mode 2023-08-25 07:42:59 +01:00
phy net: sfp: add quirk for FS's 2.5G copper SFP 2023-11-28 17:19:38 +00:00
plip
ppp ppp: limit MRU to 64K 2023-11-28 17:19:51 +00:00
pse-pd
slip
team team: fix null-ptr-deref when team device type is changed 2023-09-19 16:28:37 +02:00
thunderbolt net: thunderbolt: Fix TCPv6 GSO checksum calculation 2023-09-15 13:45:05 +01:00
usb r8152: break the loop when the budget is exhausted 2023-11-20 11:59:00 +01:00
vmxnet3
vxlan vxlan: Add missing entries to vxlan_get_size() 2023-09-20 09:00:54 +01:00
wan drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close() 2023-09-22 08:19:18 +01:00
wireguard
wireless wifi: wilc1000: use vmm_table as array in wilc struct 2023-11-28 17:20:02 +00:00
wwan Revert "net: wwan: iosm: enable runtime pm support for 7560" 2023-10-18 11:08:52 +01:00
xen-netback xen-netback: use default TX queue size for vifs 2023-10-08 13:53:10 +01:00
amt.c
bareudp.c
dummy.c
eql.c
geneve.c
gtp.c udp: annotate data-races around udp->encap_type 2023-11-20 11:58:56 +01:00
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macsec.c net: add DEV_STATS_READ() helper 2023-11-20 11:59:04 +01:00
macvlan.c macvlan: Don't propagate promisc change to lower dev in passthru 2023-11-28 17:19:54 +00:00
macvtap.c
Makefile
mdio.c
mhi_net.c
mii.c
net_failover.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c
tun.c tun: prevent negative ifindex 2023-10-17 17:44:51 -07:00
veth.c veth: Update XDP feature set when bringing up device 2023-09-12 16:32:56 +02:00
virtio_net.c virtio_net: use u64_stats_t infra to avoid data-races 2023-11-20 11:59:03 +01:00
vrf.c sysctl-6.6-rc1 2023-08-29 17:39:15 -07:00
vsockmon.c
xen-netfront.c