Patch "wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_rx_radar_detected()" has been added to the 6.2-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_rx_radar_detected()

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-mt76-mt7996-fix-insecure-data-handling-of-mt799.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit eb7dd32b311b45a3c0f1090135f21a81e1987496
Author: Ryder Lee <ryder.lee@xxxxxxxxxxxx>
Date:   Sat Dec 3 11:22:24 2022 +0800

    wifi: mt76: mt7996: fix insecure data handling of mt7996_mcu_rx_radar_detected()
    
    [ Upstream commit f37c6e5c75029443bc72c45acf92b2f2de2945be ]
    
    Coverity message:
    using tainted "r->band_idx" variable as an index into an array "(*dev).mt76.phys".
    
    Reported-by: coverity-bot <keescook+coverity-bot@xxxxxxxxxxxx>
    Addresses-Coverity-ID: 1527812 ("Insecure data handling")
    Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices")
    Signed-off-by: Ryder Lee <ryder.lee@xxxxxxxxxxxx>
    Signed-off-by: Felix Fietkau <nbd@xxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
index a90b7ca2df63c..efb245c8ac840 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
@@ -335,6 +335,9 @@ mt7996_mcu_rx_radar_detected(struct mt7996_dev *dev, struct sk_buff *skb)
 
 	r = (struct mt7996_mcu_rdd_report *)skb->data;
 
+	if (r->band_idx >= ARRAY_SIZE(dev->mt76.phys))
+		return;
+
 	mphy = dev->mt76.phys[r->band_idx];
 	if (!mphy)
 		return;



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux