• Qiujun Huang's avatar
    ath9x: Fix stack-out-of-bounds Write in ath9k_hif_usb_rx_cb · 19d6c375
    Qiujun Huang authored
    Add barrier to accessing the stack array skb_pool.
    
    The case reported by syzbot:
    https://lore.kernel.org/linux-usb/0000000000003d7c1505a2168418@google.com
    BUG: KASAN: stack-out-of-bounds in ath9k_hif_usb_rx_stream
    drivers/net/wireless/ath/ath9k/hif_usb.c:626 [inline]
    BUG: KASAN: stack-out-of-bounds in ath9k_hif_usb_rx_cb+0xdf6/0xf70
    drivers/net/wireless/ath/ath9k/hif_usb.c:666
    Write of size 8 at addr ffff8881db309a28 by task swapper/1/0
    
    Call Trace:
    ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:626
    [inline]
    ath9k_hif_usb_rx_cb+0xdf6/0xf70
    drivers/net/wireless/ath/ath9k/hif_usb.c:666
    __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1648
    usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1713
    dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966
    call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404
    expire_timers kernel/time/timer.c:1449 [inline]
    __run_timers kernel/time/timer.c:1773 [inline]
    __run_timers kernel/time/timer.c:1740 [inline]
    run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786
    
    Reported-and-tested-by: syzbot+d403396d4df67ad0bd5f@syzkaller.appspotmail.com
    Signed-off-by: default avatarQiujun Huang <hqjagain@gmail.com>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20200404041838.10426-5-hqjagain@gmail.com
    19d6c375
hif_usb.c 32.6 KB