APPLIED: [SRU][F][PATCH 0/1] CVE-2023-52531

[Stefan Bader]

On 17.09.24 06:55, Koichiro Den wrote:
> [Impact]
> 
> wifi: iwlwifi: mvm: Fix a memory corruption issue
> 
> A few lines above, space is kzalloc()'ed for:
> 	sizeof(struct iwl_nvm_data) +
> 	sizeof(struct ieee80211_channel) +
> 	sizeof(struct ieee80211_rate)
> 
> 'mvm->nvm_data' is a 'struct iwl_nvm_data', so it is fine.
> 
> At the end of this structure, there is the 'channels' flex array.
> Each element is of type 'struct ieee80211_channel'.
> So only 1 element is allocated in this array.
> 
> When doing:
>    mvm->nvm_data->bands[0].channels = mvm->nvm_data->channels;
> We point at the first element of the 'channels' flex array.
> So this is fine.
> 
> However, when doing:
>    mvm->nvm_data->bands[0].bitrates =
> 			(void *)((u8 *)mvm->nvm_data->channels + 1);
> because of the "(u8 *)" cast, we add only 1 to the address of the beginning
> of the flex array.
> 
> It is likely that we want point at the 'struct ieee80211_rate' allocated
> just after.
> 
> Remove the spurious casting so that the pointer arithmetic works as
> expected.
> 
> [Backport]
> 
> Context adjustments made due to missing commit 3827cb59b3b8
> ("iwlwifi: avoid void pointer arithmetic") and its dependencies.
> 
> [Fix]
> 
> Noble:  not affected
> Jammy:  fixed via stable
> Focal:  Backport - adjusted contexts due to missing commits, see [Backport]
> Bionic: fix sent to esm ML
> Xenial: fix sent to esm ML
> Trusty: not affected
> 
> [Test case]
> 
> Compile and boot tested
> 
> [Where problem could occur]
> 
> This fix affects those who use iwlwifi driver, an issue with this fix
> would be visible to the user via unpredicted driver behavior.
> 
> 
> Christophe JAILLET (1):
>    wifi: iwlwifi: mvm: Fix a memory corruption issue
> 
>   drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 

Applied to focal:linux/master-next. Thanks.

-Stefan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240925/c6dd092d/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240925/c6dd092d/attachment-0001.sig>