> -----Original Message-----
> From: Li Zetao <lizetao1@xxxxxxxxxx>
> Sent: Monday, December 12, 2022 10:36 AM
> To: Ping-Ke Shih <pkshih@xxxxxxxxxxx>
> Cc: Larry.Finger@xxxxxxxxxxxx; davem@xxxxxxxxxxxxx; edumazet@xxxxxxxxxx; kuba@xxxxxxxxxx;
> kvalo@xxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; linux-wireless@xxxxxxxxxxxxxxx; linville@xxxxxxxxxxxxx;
> lizetao1@xxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; pabeni@xxxxxxxxxx
> Subject: [PATCH v3] rtlwifi: rtl8821ae: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
>
> There is a global-out-of-bounds reported by KASAN:
>
> BUG: KASAN: global-out-of-bounds in
> _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
> Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411
>
> CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D
> 6.1.0-rc8+ #144 e15588508517267d37
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
> Call Trace:
> <TASK>
> ...
> kasan_report+0xbb/0x1c0
> _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae]
> rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae]
> rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae]
> ...
> </TASK>
>
> The root cause of the problem is that the comparison order of
> "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The
> _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two
> strings from tail to head, which causes the problem. In the
> _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet
> this requirement by carefully designing the comparison order.
> For example, "pregulation" and "pbandwidth" are compared in order of
> length from small to large, first is 3 and last is 4. However, the
> comparison order of "prate_section" dose not obey such order requirement,
> therefore when "prate_section" is "HT", when comparing from tail to head,
> it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As
> mentioned above, the _rtl8812ae_eq_n_byte() has the same function as
> strcmp(), so just strcmp() is enough.
>
> Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely.
> Although it can be fixed by adjusting the comparison order of
> "prate_section", this may cause the value of "rate_section" to not be
> from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver
> from staging to regular tree, but also added setting txpower limit
> function during the driver config phase, so the problem was introduced
> by this commit.
>
> Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree")
> Signed-off-by: Li Zetao <lizetao1@xxxxxxxxxx>
Thanks for your fix.
Acked-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>
> ---
> v1 -> v2: delete the third parameter of _rtl8812ae_eq_n_byte() and use
> strcmp to replace loop comparison.
> v2 -> v3: remove _rtl8812ae_eq_n_byte() and use strcmp() barely.
>
> .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 52 +++++++------------
> 1 file changed, 20 insertions(+), 32 deletions(-)
>
[...]
