We are in custody of an inheritance attached to your surname.
Contact Mr Mark Tucker on mark00tucker(a)naver.com with your full
names for validation. Ts & Cs apply
From: Sherry Sun <sherry.sun(a)nxp.com>
[ Upstream commit fcb10ee27fb91b25b68d7745db9817ecea9f1038 ]
We should be very careful about the register values that will be used
for division or modulo operations, althrough the possibility that the
UARTBAUD register value is zero is very low, but we had better to deal
with the "bad data" of hardware in advance to avoid division or modulo
by zero leading to undefined kernel behavior.
Signed-off-by: Sherry Sun <sherry.sun(a)nxp.com>
Link: https://lore.kernel.org/r/20210427021226.27468-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/tty/serial/fsl_lpuart.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index 4b9f42269477..deb9d4fa9cb0 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1992,6 +1992,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud,
bd = lpuart32_read(&sport->port, UARTBAUD);
bd &= UARTBAUD_SBR_MASK;
+ if (!bd)
+ return;
+
sbr = bd;
uartclk = clk_get_rate(sport->clk);
/*
--
2.30.2
In the rtw_pci_init_rx_ring function the "if (len > TRX_BD_IDX_MASK)"
statement guarantees that len is less than or equal to GENMASK(11, 0) or
in other words that len is less than or equal to 4095. However the
rx_ring->buf has a size of RTK_MAX_RX_DESC_NUM (defined as 512). This
way it is possible an out-of-bounds write in the for statement due to
the i variable can exceed the rx_ring->buff size.
However, this overflow never happens due to the rtw_pci_init_rx_ring is
only ever called with a fixed constant of RTK_MAX_RX_DESC_NUM. But it is
better to be defensive in this case and add a new check to avoid
overflows if this function is called in a future with a value greater
than 512.
Cc: stable(a)vger.kernel.org
Addresses-Coverity-ID: 1461515 ("Out-of-bounds write")
Fixes: e3037485c68ec ("rtw88: new Realtek 802.11ac driver")
Signed-off-by: Len Baker <len.baker(a)gmx.com>
---
Changelog v1 -> v2
- Remove the macro ARRAY_SIZE from the for loop (Pkshih, Brian Norris).
- Add a new check for the len variable (Pkshih, Brian Norris).
drivers/net/wireless/realtek/rtw88/pci.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c
index e7d17ab8f113..53dc90276693 100644
--- a/drivers/net/wireless/realtek/rtw88/pci.c
+++ b/drivers/net/wireless/realtek/rtw88/pci.c
@@ -273,6 +273,11 @@ static int rtw_pci_init_rx_ring(struct rtw_dev *rtwdev,
return -EINVAL;
}
+ if (len > ARRAY_SIZE(rx_ring->buf)) {
+ rtw_err(rtwdev, "len %d exceeds maximum RX ring buffer\n", len);
+ return -EINVAL;
+ }
+
head = dma_alloc_coherent(&pdev->dev, ring_sz, &dma, GFP_KERNEL);
if (!head) {
rtw_err(rtwdev, "failed to allocate rx ring\n");
--
2.25.1
In v4.4, commit e76511a6fbb5 ("mac80211: properly handle A-MSDUs that
start with an RFC 1042 header") looks like an incomplete backport.
There is no functional changes in the commit, since
__ieee80211_data_to_8023() which defined in net/wireless/util.c is
only called by ieee80211_data_to_8023() and parameter 'is_amsdu' is
always input as false.
By comparing with its upstream, I found that following snippet has not
been backported:
> --- a/net/mac80211/rx.c
> +++ b/net/mac80211/rx.c
> @@ -2682,7 +2682,7 @@ __ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx, u8 data_offset)
> if (ieee80211_data_to_8023_exthdr(skb, ðhdr,
> rx->sdata->vif.addr,
> rx->sdata->vif.type,
> - data_offset))
> + data_offset, true))
> return RX_DROP_UNUSABLE;
I think that's where really causing changes and also needs to be
backported, so I try to do it.
Fixes: e76511a6fbb5 ("mac80211: properly handle A-MSDUs that start with an RFC 1042 header")
Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com>
---
net/wireless/util.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 84c0a96b3cb6d..a2b35e6619697 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -664,7 +664,7 @@ void ieee80211_amsdu_to_8023s(struct sk_buff *skb, struct sk_buff_head *list,
u8 dst[ETH_ALEN], src[ETH_ALEN];
if (has_80211_header) {
- err = ieee80211_data_to_8023(skb, addr, iftype);
+ err = __ieee80211_data_to_8023(skb, addr, iftype, true);
if (err)
goto out;
--
2.31.1