[SRU][F][PATCH 0/1] CVE-2023-52531

[Koichiro Den]

[Impact]

wifi: iwlwifi: mvm: Fix a memory corruption issue

A few lines above, space is kzalloc()'ed for:
	sizeof(struct iwl_nvm_data) +
	sizeof(struct ieee80211_channel) +
	sizeof(struct ieee80211_rate)

'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine.

At the end of this structure, there is the 'channels' flex array.
Each element is of type 'struct ieee80211_channel'.
So only 1 element is allocated in this array.

When doing:
  mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels;
We point at the first element of the 'channels' flex array.
So this is fine.

However, when doing:
  mvm->nvm_data->bands[0].bitrates =
			(void *)((u8 *)mvm->nvm_data->channels + 1);
because of the "(u8 *)" cast, we add only 1 to the address of the beginning
of the flex array.

It is likely that we want point at the 'struct ieee80211_rate' allocated
just after.

Remove the spurious casting so that the pointer arithmetic works as
expected.

[Backport]

Context adjustments made due to missing commit 3827cb59b3b8
("iwlwifi: avoid void pointer arithmetic") and its dependencies.

[Fix]

Noble:  not affected
Jammy:  fixed via stable
Focal:  Backport - adjusted contexts due to missing commits, see [Backport]
Bionic: fix sent to esm ML
Xenial: fix sent to esm ML
Trusty: not affected

[Test case]

Compile and boot tested

[Where problem could occur]

This fix affects those who use iwlwifi driver, an issue with this fix
would be visible to the user via unpredicted driver behavior.


Christophe JAILLET (1):
  wifi: iwlwifi: mvm: Fix a memory corruption issue

 drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.43.0