• Ping-Ke Shih's avatar
    rtw89: cfo: check mac_id to avoid out-of-bounds · 97df8587
    Ping-Ke Shih authored
    Somehow, hardware reports incorrect mac_id and pollute memory. Check index
    before we access the array.
    
      UBSAN: array-index-out-of-bounds in rtw89/phy.c:2517:23
      index 188 is out of range for type 's32 [64]'
      CPU: 1 PID: 51550 Comm: irq/35-rtw89_pc Tainted: G           OE
      Call Trace:
       <IRQ>
       show_stack+0x52/0x58
       dump_stack_lvl+0x4c/0x63
       dump_stack+0x10/0x12
       ubsan_epilogue+0x9/0x45
       __ubsan_handle_out_of_bounds.cold+0x44/0x49
       ? __alloc_skb+0x92/0x1d0
       rtw89_phy_cfo_parse+0x44/0x7f [rtw89_core]
       rtw89_core_rx+0x261/0x871 [rtw89_core]
       ? __alloc_skb+0xee/0x1d0
       rtw89_pci_napi_poll+0x3fa/0x4ea [rtw89_pci]
       __napi_poll+0x33/0x1a0
       net_rx_action+0x126/0x260
       ? __queue_work+0x217/0x4c0
       __do_softirq+0xd9/0x315
       ? disable_irq_nosync+0x10/0x10
       do_softirq.part.0+0x6d/0x90
       </IRQ>
       <TASK>
       __local_bh_enable_ip+0x62/0x70
       rtw89_pci_interrupt_threadfn+0x182/0x1a6 [rtw89_pci]
       irq_thread_fn+0x28/0x60
       irq_thread+0xc8/0x190
       ? irq_thread_fn+0x60/0x60
       kthread+0x16b/0x190
       ? irq_thread_check_affinity+0xe0/0xe0
       ? set_kthread_struct+0x50/0x50
       ret_from_fork+0x22/0x30
       </TASK>
    Signed-off-by: default avatarPing-Ke Shih <pkshih@realtek.com>
    Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
    Link: https://lore.kernel.org/r/20220516005215.5878-4-pkshih@realtek.com
    97df8587
phy.c 107 KB