mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
19d6c375d6
Add barrier to accessing the stack array skb_pool. The case reported by syzbot: https://lore.kernel.org/linux-usb/0000000000003d7c1505a2168418@google.com BUG: KASAN: stack-out-of-bounds in ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:626 [inline] BUG: KASAN: stack-out-of-bounds in ath9k_hif_usb_rx_cb+0xdf6/0xf70 drivers/net/wireless/ath/ath9k/hif_usb.c:666 Write of size 8 at addr ffff8881db309a28 by task swapper/1/0 Call Trace: ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:626 [inline] ath9k_hif_usb_rx_cb+0xdf6/0xf70 drivers/net/wireless/ath/ath9k/hif_usb.c:666 __usb_hcd_giveback_urb+0x1f2/0x470 drivers/usb/core/hcd.c:1648 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1713 dummy_timer+0x1258/0x32ae drivers/usb/gadget/udc/dummy_hcd.c:1966 call_timer_fn+0x195/0x6f0 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x5f9/0x1500 kernel/time/timer.c:1786 Reported-and-tested-by: syzbot+d403396d4df67ad0bd5f@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang <hqjagain@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20200404041838.10426-5-hqjagain@gmail.com |
||
|---|---|---|
| .. | ||
| ahb.c | ||
| ani.c | ||
| ani.h | ||
| antenna.c | ||
| ar953x_initvals.h | ||
| ar955x_1p0_initvals.h | ||
| ar956x_initvals.h | ||
| ar5008_initvals.h | ||
| ar5008_phy.c | ||
| ar9001_initvals.h | ||
| ar9002_calib.c | ||
| ar9002_hw.c | ||
| ar9002_initvals.h | ||
| ar9002_mac.c | ||
| ar9002_phy.c | ||
| ar9002_phy.h | ||
| ar9003_2p2_initvals.h | ||
| ar9003_aic.c | ||
| ar9003_aic.h | ||
| ar9003_buffalo_initvals.h | ||
| ar9003_calib.c | ||
| ar9003_eeprom.c | ||
| ar9003_eeprom.h | ||
| ar9003_hw.c | ||
| ar9003_mac.c | ||
| ar9003_mac.h | ||
| ar9003_mci.c | ||
| ar9003_mci.h | ||
| ar9003_paprd.c | ||
| ar9003_phy.c | ||
| ar9003_phy.h | ||
| ar9003_rtt.c | ||
| ar9003_rtt.h | ||
| ar9003_wow.c | ||
| ar9330_1p1_initvals.h | ||
| ar9330_1p2_initvals.h | ||
| ar9340_initvals.h | ||
| ar9462_2p0_initvals.h | ||
| ar9462_2p1_initvals.h | ||
| ar9485_initvals.h | ||
| ar9565_1p0_initvals.h | ||
| ar9565_1p1_initvals.h | ||
| ar9580_1p0_initvals.h | ||
| ath9k.h | ||
| ath9k_pci_owl_loader.c | ||
| beacon.c | ||
| btcoex.c | ||
| btcoex.h | ||
| calib.c | ||
| calib.h | ||
| channel.c | ||
| common-beacon.c | ||
| common-beacon.h | ||
| common-debug.c | ||
| common-debug.h | ||
| common-init.c | ||
| common-init.h | ||
| common-spectral.c | ||
| common-spectral.h | ||
| common.c | ||
| common.h | ||
| debug.c | ||
| debug.h | ||
| debug_sta.c | ||
| dfs.c | ||
| dfs.h | ||
| dfs_debug.c | ||
| dfs_debug.h | ||
| dynack.c | ||
| dynack.h | ||
| eeprom.c | ||
| eeprom.h | ||
| eeprom_4k.c | ||
| eeprom_9287.c | ||
| eeprom_def.c | ||
| gpio.c | ||
| hif_usb.c | ||
| hif_usb.h | ||
| htc.h | ||
| htc_drv_beacon.c | ||
| htc_drv_debug.c | ||
| htc_drv_gpio.c | ||
| htc_drv_init.c | ||
| htc_drv_main.c | ||
| htc_drv_txrx.c | ||
| htc_hst.c | ||
| htc_hst.h | ||
| hw-ops.h | ||
| hw.c | ||
| hw.h | ||
| init.c | ||
| Kconfig | ||
| link.c | ||
| mac.c | ||
| mac.h | ||
| main.c | ||
| Makefile | ||
| mci.c | ||
| mci.h | ||
| pci.c | ||
| phy.h | ||
| recv.c | ||
| reg.h | ||
| reg_aic.h | ||
| reg_mci.h | ||
| reg_wow.h | ||
| rng.c | ||
| tx99.c | ||
| wmi.c | ||
| wmi.h | ||
| wow.c | ||
| xmit.c | ||