Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJiri Slaby <jslaby@suse.cz>2019-08-16 22:01:45 +0200
committerJiri Slaby <jslaby@suse.cz>2019-08-16 22:25:11 +0200
commit940405ae49400290111fbf416058831e17aa1c0a (patch)
treee8cd50e79d08fbf91e6b91f45fcc2adaf993b504
parent14df68827c73ea70e567f47c9a9515a4cbd0cb05 (diff)
iwlwifi: mvm: fix an out-of-bound access (bnc#1012628).
-rw-r--r--patches.kernel.org/5.2.9-141-iwlwifi-mvm-fix-an-out-of-bound-access.patch43
-rw-r--r--series.conf1
2 files changed, 44 insertions, 0 deletions
diff --git a/patches.kernel.org/5.2.9-141-iwlwifi-mvm-fix-an-out-of-bound-access.patch b/patches.kernel.org/5.2.9-141-iwlwifi-mvm-fix-an-out-of-bound-access.patch
new file mode 100644
index 0000000000..92d1da3609
--- /dev/null
+++ b/patches.kernel.org/5.2.9-141-iwlwifi-mvm-fix-an-out-of-bound-access.patch
@@ -0,0 +1,43 @@
+From: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Date: Mon, 22 Jul 2019 12:47:27 +0300
+Subject: [PATCH] iwlwifi: mvm: fix an out-of-bound access
+References: bnc#1012628
+Patch-mainline: 5.2.9
+Git-commit: ba3224db78034435e9ff0247277cce7c7bb1756c
+
+commit ba3224db78034435e9ff0247277cce7c7bb1756c upstream.
+
+The index for the elements of the ACPI object we dereference
+was static. This means that if we called the function twice
+we wouldn't start from 3 again, but rather from the latest
+index we reached in the previous call.
+This was dutifully reported by KASAN.
+
+Fix this.
+
+Cc: stable@vger.kernel.org
+Fixes: 6996490501ed ("iwlwifi: mvm: add support for EWRD (Dynamic SAR) ACPI table")
+Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Jiri Slaby <jslaby@suse.cz>
+---
+ drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+index 559f6df1a74d..1ae6753b005a 100644
+--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+@@ -753,7 +753,7 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm)
+
+ for (i = 0; i < n_profiles; i++) {
+ /* the tables start at element 3 */
+- static int pos = 3;
++ int pos = 3;
+
+ /* The EWRD profiles officially go from 2 to 4, but we
+ * save them in sar_profiles[1-3] (because we don't
+--
+2.22.0
+
diff --git a/series.conf b/series.conf
index 09118dac05..39dff01d56 100644
--- a/series.conf
+++ b/series.conf
@@ -1161,6 +1161,7 @@
patches.kernel.org/5.2.9-138-KVM-arm-arm64-Sync-ICH_VMCR_EL2-back-when-about.patch
patches.kernel.org/5.2.9-139-mwifiex-fix-802.11n-WPA-detection.patch
patches.kernel.org/5.2.9-140-iwlwifi-don-t-unmap-as-page-memory-that-was-map.patch
+ patches.kernel.org/5.2.9-141-iwlwifi-mvm-fix-an-out-of-bound-access.patch
########################################################
# Build fixes that apply to the vanilla kernel too.