diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-08-13 17:12:53 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-10-29 09:03:02 +0100 |
| commit | a7937ef66b18f74b47074d72cfa07c17d3b874ba (patch) | |
| tree | caaa2e2baf934393a33c328c525f0f47e6be2e19 /tools/perf/scripts/python/bin | |
| parent | cf3627c600cf0cfd5d1edab913f54de4087b1e11 (diff) | |
ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb()
[ Upstream commit 2705cd7558e718a7240c64eb0afb2edad5f8c190 ]
The value of "htc_hdr->endpoint_id" comes from skb->data so Smatch marks
it as untrusted so we have to check it before using it as an array
offset.
This is similar to a bug that syzkaller found in commit e4ff08a4d727
("ath9k: Fix use-after-free Write in ath9k_htc_rx_msg") so it is
probably a real issue.
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200813141253.GA457408@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/bin')
0 files changed, 0 insertions, 0 deletions