mirror of
https://github.com/torvalds/linux.git
synced 2026-10-16 21:00:02 +02:00
e6c5ed7a98
When a key is removed (data == NULL), rsi_hal_load_key() runs:
memset(&set_key[FRAME_DESC_SZ], 0, frame_len - FRAME_DESC_SZ);
set_key is a struct rsi_set_key *, so the subscript is scaled by
sizeof(struct rsi_set_key) (160 bytes): &set_key[FRAME_DESC_SZ] is
skb->data + 2560, and the memset writes 144 zero bytes starting
2.4KB past the end of the 160-byte skb data buffer, corrupting
unrelated heap objects. The intended byte offset would have been
(u8 *)set_key + FRAME_DESC_SZ.
The write fires on every DISABLE_KEY callback, so plain disconnects,
roams and interface teardowns trigger it on real networks.
The memset is redundant: the whole buffer is zeroed right after
allocation, so the frame sent to the device is byte-identical
without it. Drop the else branch; normal operation is unaffected.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| rsi_91x_coex.c | ||
| rsi_91x_core.c | ||
| rsi_91x_debugfs.c | ||
| rsi_91x_hal.c | ||
| rsi_91x_mac80211.c | ||
| rsi_91x_main.c | ||
| rsi_91x_mgmt.c | ||
| rsi_91x_ps.c | ||
| rsi_91x_sdio_ops.c | ||
| rsi_91x_sdio.c | ||
| rsi_91x_usb_ops.c | ||
| rsi_91x_usb.c | ||
| rsi_boot_params.h | ||
| rsi_coex.h | ||
| rsi_common.h | ||
| rsi_debugfs.h | ||
| rsi_hal.h | ||
| rsi_main.h | ||
| rsi_mgmt.h | ||
| rsi_ps.h | ||
| rsi_sdio.h | ||
| rsi_usb.h | ||