From nobody Sat Sep 26 20:29:40 2026 Received: from sg-2-1.ptr.blmpb.com (sg-2-1.ptr.blmpb.com [71.18.227.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F011244694 for ; Sun, 30 Aug 2026 18:42:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=71.18.227.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788115346; cv=none; b=kqIaiW07zdur4xPOP4ipXDWNbTBavARzKIbL3MH6ozFDaTD6bwHDfK16iKyU1DUezULBefoL5dlfPa/qadLOJQVJBf6X5hkSsUwJfRMaCODMhQbRrwugMZ7IhituLW/sVZrycaWxXzl1mFpOl1+DwlJylfUl7NMoJzC8124n63c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788115346; c=relaxed/simple; bh=qcWikxX63RDf+q1f319g6Cdqm4MSPds23j+RGAf3Z/Q=; h=Date:Message-Id:To:Content-Type:In-Reply-To:Cc:From:Subject: Mime-Version:References; b=bAr/LcaIhHtIN76kXpW/2ssxapWsBQnIqCo71ULnjiCVxkxKrXyqCEvPsh+e4megadYYu8lAMBywLAhGOi4c8YxCA08sG/UtCs1zSRutWsMD/l/cz4q7H7SkpDKDUrC72vSPzUmcrnqRHWZ7lhbqwnP+doECLIJdtoBo/X24BZw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b=Er4sR+X7; arc=none smtp.client-ip=71.18.227.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b="Er4sR+X7" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1788115337; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=S2oGoSOjmfoakjBqcCh3/7CaRO1KAtC9csSDQBDkjrM=; b=Er4sR+X7V2QMJZOoY8TBjC+DM50q8AuCD3MdouvE5KKkbstSXyKN4hBm9oFXu3KQSLr07o AtjyAmQh3tbJYjUagjoVbEpWOiaNX2DtI3lllNuWHANx4OIz5/5cnRtszoJlvSuIwSVklv Q5eTWF5EfcPqNvCpwjlvZhqTA8HD2MbevkdEA0y4hFHTMCFP6mPS6rNVH9n1b/LibyuNz/ g+T8K4l0YMMJID/GUCKKaLqqfTQbfLKArpLWgM5MO/mThA1Xc490RsJkKF6kAFUIPHAk8Q ZIUjbwh+SeW6T9+J7pABrbDXXDOw8WMLGoZOEXwGymp067z5M2Qeq0zNPqTOpQ== Date: Mon, 31 Aug 2026 02:42:12 +0800 Message-Id: <20260831-p54-pda-validation-v2-1-dae566b388c8@cherr.cc> X-Mailer: b4 0.16.0 To: "Christian Lamparter" , "Michael Wu" , "David S. Miller" , "John W. Linville" Received: from [192.168.9.107] ([111.42.148.195]) by smtp.feishu.cn with ESMTPS; Mon, 31 Aug 2026 02:42:15 +0800 In-Reply-To: <20260831-p54-pda-validation-v2-0-dae566b388c8@cherr.cc> X-Original-From: Shengzhuo Wei X-Lms-Return-Path: Content-Transfer-Encoding: quoted-printable Cc: , , , "Shengzhuo Wei" From: "Shengzhuo Wei" Subject: [PATCH v2 1/2] wifi: p54: validate curve data length in the calibration curve converters Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260831-p54-pda-validation-v2-0-dae566b388c8@cherr.cc> Content-Type: text/plain; charset="utf-8" p54_convert_rev0() and p54_convert_rev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54_convert_output_limits() and p54_convert_db() already validate their counts against the entry length; this path was missed. Reject the entry when the counts do not fit in the entry data. Fixes: eff1a59c48e3 ("[P54]: add mac80211-based driver for prism54 softmac = hardware") Cc: stable@vger.kernel.org Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei Acked-by: Christian Lamparter --- drivers/net/wireless/intersil/p54/eeprom.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wirel= ess/intersil/p54/eeprom.c index 95580921d933..0dc848d77c5e 100644 --- a/drivers/net/wireless/intersil/p54/eeprom.c +++ b/drivers/net/wireless/intersil/p54/eeprom.c @@ -414,17 +414,22 @@ static int p54_generate_channel_lists(struct ieee8021= 1_hw *dev) } =20 static int p54_convert_rev0(struct ieee80211_hw *dev, - struct pda_pa_curve_data *curve_data) + struct pda_pa_curve_data *curve_data, size_t len) { struct p54_common *priv =3D dev->priv; struct p54_pa_curve_data_sample *dst; struct pda_pa_curve_data_sample_rev0 *src; + size_t needed =3D curve_data->channels * + (sizeof(*src) * curve_data->points_per_channel + 2); size_t cd_len =3D sizeof(*curve_data) + (curve_data->points_per_channel*sizeof(*dst) + 2) * curve_data->channels; unsigned int i, j; void *source, *target; =20 + if (len < sizeof(*curve_data) + needed) + return -EINVAL; + priv->curve_data =3D kmalloc(sizeof(*priv->curve_data) + cd_len, GFP_KERNEL); if (!priv->curve_data) @@ -466,17 +471,22 @@ static int p54_convert_rev0(struct ieee80211_hw *dev, } =20 static int p54_convert_rev1(struct ieee80211_hw *dev, - struct pda_pa_curve_data *curve_data) + struct pda_pa_curve_data *curve_data, size_t len) { struct p54_common *priv =3D dev->priv; struct p54_pa_curve_data_sample *dst; struct pda_pa_curve_data_sample_rev1 *src; + size_t needed =3D curve_data->channels * + (sizeof(*src) * curve_data->points_per_channel + 3); size_t cd_len =3D sizeof(*curve_data) + (curve_data->points_per_channel*sizeof(*dst) + 2) * curve_data->channels; unsigned int i, j; void *source, *target; =20 + if (len < sizeof(*curve_data) + needed) + return -EINVAL; + priv->curve_data =3D kzalloc(cd_len + sizeof(*priv->curve_data), GFP_KERNEL); if (!priv->curve_data) @@ -763,6 +773,7 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *ee= prom, int len) case PDR_PRISM_PA_CAL_CURVE_DATA: { struct pda_pa_curve_data *curve_data =3D (struct pda_pa_curve_data *)entry->data; + if (data_len < sizeof(*curve_data)) { err =3D -EINVAL; goto err; @@ -770,10 +781,10 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *= eeprom, int len) =20 switch (curve_data->cal_method_rev) { case 0: - err =3D p54_convert_rev0(dev, curve_data); + err =3D p54_convert_rev0(dev, curve_data, data_len); break; case 1: - err =3D p54_convert_rev1(dev, curve_data); + err =3D p54_convert_rev1(dev, curve_data, data_len); break; default: wiphy_err(dev->wiphy, --=20 2.47.3 From nobody Sat Sep 26 20:29:40 2026 Received: from sg-2-3.ptr.blmpb.com (sg-2-3.ptr.blmpb.com [71.18.227.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C55B93019A9 for ; Sun, 30 Aug 2026 18:42:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=71.18.227.3 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788115351; cv=none; b=tAqAoqUZU9cccW1ljA+efz/nxZ0xrxLh3upb0lyWegUFx3FgYXY9lCyhKClxHoaXb8AgHIPXDzlkOq5Ih7GC+pCsIwWmXmYKNxYmjFy33Om+fzokxXyEmrvOjqCsga+56DBYyS3YxB2D2UKHAdJV0Id+5WUQrkRjECoNJ6nSSxw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788115351; c=relaxed/simple; bh=CL0/kY3bZfJVBbAxvDY0/bQoDkW/j7WSp2TzqY/TE7I=; h=Mime-Version:In-Reply-To:To:Subject:Message-Id:References: Content-Type:Date:Cc:From; b=CnHSkEiXboYLnkCAsbwjOcEC/8bM8UrPjrbDv/D5nBcglEchgQscM/2y3OE3Ls9a+Ylb9qcV99Wf8+GLDy9soaQ4zSAMB4/6veH8zQ5vuslWJarpJp/Qj8e8kDuCDCbm+Q3enjwhr+SnOCCQ3mHbg+uQLB51fivU7U8nnP6K4PA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b=Mx2foPvK; arc=none smtp.client-ip=71.18.227.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b="Mx2foPvK" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1788115338; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=7KRhxGIVwdrzN+rJYLkuSNUS8MiHyIi4c/SKannXfOI=; b=Mx2foPvKWAwGNZtoxnw0/HO9s4PNHmiDi4hNueRtO8nncKT204MTnh+BJXqjr0WPfjT3Cq 3v6xeSetoaHr9zmhdsZYuQ8baTnsHfbaALM3uZQFICyfhU9rXFc8Fo5YI2XNtWtkQyXHVb a8wagT7WSobEUjNeieObXfhaqdAj0QDoCVL6eT+yrK3Kxul+C1kEr/wkPMTVhbhwRSVtOo thlET6oGXcIceqVGgSI3fkdvEWChk4bkSKdPZujeMG84P0uRL7MzxczvPQv3EJ2DZ+Pn12 BiR0C+FkgtlytGJiY4mERAlsshoMP4Eg9P/Rk4ykpK307sgrUd184Ok3dY+8gw== Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 In-Reply-To: <20260831-p54-pda-validation-v2-0-dae566b388c8@cherr.cc> Received: from [192.168.9.107] ([111.42.148.195]) by smtp.feishu.cn with ESMTPS; Mon, 31 Aug 2026 02:42:16 +0800 Content-Transfer-Encoding: quoted-printable X-Lms-Return-Path: To: "Christian Lamparter" , "Michael Wu" , "David S. Miller" , "John W. Linville" Subject: [PATCH v2 2/2] wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST Message-Id: <20260831-p54-pda-validation-v2-2-dae566b388c8@cherr.cc> X-Original-From: Shengzhuo Wei References: <20260831-p54-pda-validation-v2-0-dae566b388c8@cherr.cc> Date: Mon, 31 Aug 2026 02:42:13 +0800 X-Mailer: b4 0.16.0 Cc: , , , "Christian Lamparter" , "Shengzhuo Wei" From: "Shengzhuo Wei" Content-Type: text/plain; charset="utf-8" The PDR_INTERFACE_LIST loop only checks that the record start is within the entry before reading an entire struct exp_if from it. A truncated trailing record makes the if_id/variant reads cross the entry boundary into the heap beyond the EEPROM buffer (verified with a KASAN reproducer of the loop). The variant also feeds the synth front-end selection, so this is not only a leak. Advance only while a full record still fits in the entry. Fixes: eff1a59c48e3 ("[P54]: add mac80211-based driver for prism54 softmac = hardware") Cc: stable@vger.kernel.org Acked-by: Christian Lamparter Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- drivers/net/wireless/intersil/p54/eeprom.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wirel= ess/intersil/p54/eeprom.c index 0dc848d77c5e..0475222d54fc 100644 --- a/drivers/net/wireless/intersil/p54/eeprom.c +++ b/drivers/net/wireless/intersil/p54/eeprom.c @@ -812,7 +812,8 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *ee= prom, int len) break; case PDR_INTERFACE_LIST: tmp =3D entry->data; - while ((u8 *)tmp < entry->data + data_len) { + while ((u8 *)tmp + sizeof(struct exp_if) <=3D + entry->data + data_len) { struct exp_if *exp_if =3D tmp; if (exp_if->if_id =3D=3D cpu_to_le16(IF_ID_ISL39000)) synth =3D le16_to_cpu(exp_if->variant); --=20 2.47.3