ACK: [SRU][F][PATCH 0/1] CVE-2023-52531

[Mehmet Basaran]

Acked-by: Mehmet Basaran <mehmet.basaran at canonical.com>

-------------- next part --------------
Koichiro Den <koichiro.den at canonical.com> writes:

> [Impact]
>
> wifi: iwlwifi: mvm: Fix a memory corruption issue
>
> A few lines above, space is kzalloc()'ed for:
> 	sizeof(struct iwl_nvm_data) +
> 	sizeof(struct ieee80211_channel) +
> 	sizeof(struct ieee80211_rate)
>
> 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine.
>
> At the end of this structure, there is the 'channels' flex array.
> Each element is of type 'struct ieee80211_channel'.
> So only 1 element is allocated in this array.
>
> When doing:
>   mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels;
> We point at the first element of the 'channels' flex array.
> So this is fine.
>
> However, when doing:
>   mvm->nvm_data->bands[0].bitrates =
> 			(void *)((u8 *)mvm->nvm_data->channels + 1);
> because of the "(u8 *)" cast, we add only 1 to the address of the beginning
> of the flex array.
>
> It is likely that we want point at the 'struct ieee80211_rate' allocated
> just after.
>
> Remove the spurious casting so that the pointer arithmetic works as
> expected.
>
> [Backport]
>
> Context adjustments made due to missing commit 3827cb59b3b8
> ("iwlwifi: avoid void pointer arithmetic") and its dependencies.
>
> [Fix]
>
> Noble:  not affected
> Jammy:  fixed via stable
> Focal:  Backport - adjusted contexts due to missing commits, see [Backport]
> Bionic: fix sent to esm ML
> Xenial: fix sent to esm ML
> Trusty: not affected
>
> [Test case]
>
> Compile and boot tested
>
> [Where problem could occur]
>
> This fix affects those who use iwlwifi driver, an issue with this fix
> would be visible to the user via unpredicted driver behavior.
>
>
> Christophe JAILLET (1):
>   wifi: iwlwifi: mvm: Fix a memory corruption issue
>
>  drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> -- 
> 2.43.0
>
>
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 873 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240918/ce391b8e/attachment.sig>