Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> The "rxstatus->rs_keyix" eventually gets passed to test_bit() so we need to
> ensure that it is within the bitmap.
>
> drivers/net/wireless/ath/ath9k/common.c:46 ath9k_cmn_rx_accept()
> error: passing untrusted data 'rx_stats->rs_keyix' to 'test_bit()'
>
> Fixes: 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxx>
> Signed-off-by: Kalle Valo <quic_kvalo@xxxxxxxxxxx>
Patch applied to ath-next branch of ath.git, thanks.
2dc509305cf9 ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
--
https://patchwork.kernel.org/project/linux-wireless/patch/20220409061225.GA5447@kili/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
