From: Dan Carpenter Date: Thu, 13 Aug 2020 14:13:15 +0000 (+0300) Subject: ath6kl: prevent potential array overflow in ath6kl_add_new_sta() X-Git-Tag: v5.15~2655^2~309^2~138^2~32 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=54f9ab7b870934b70e5a21786d951fbcf663970f;p=platform%2Fkernel%2Flinux-starfive.git ath6kl: prevent potential array overflow in ath6kl_add_new_sta() The value for "aid" comes from skb->data so Smatch marks it as untrusted. If it's invalid then it can result in an out of bounds array access in ath6kl_add_new_sta(). Fixes: 572e27c00c9d ("ath6kl: Fix AP mode connect event parsing and TIM updates") Signed-off-by: Dan Carpenter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20200813141315.GB457408@mwanda --- diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c index 2102182..d3aa9e7 100644 --- a/drivers/net/wireless/ath/ath6kl/main.c +++ b/drivers/net/wireless/ath/ath6kl/main.c @@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr, ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid); + if (aid < 1 || aid > AP_MAX_NUM_STA) + return; + if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) { struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) assoc_info;