]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: ath9k_htc: Abort software beacon handling if disabled
authorToke Høiland-Jørgensen <toke@toke.dk>
Wed, 2 Apr 2025 11:22:16 +0000 (13:22 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Jun 2025 10:05:13 +0000 (11:05 +0100)
commit7ee3fb6258da8c890a51b514f60d7570dc703605
tree18394a7575b8aa0011843df6593da880d49bd9df
parent1ee8ea6937d13b20f90ff35d71ccc03ba448182d
wifi: ath9k_htc: Abort software beacon handling if disabled

[ Upstream commit ac4e317a95a1092b5da5b9918b7118759342641c ]

A malicious USB device can send a WMI_SWBA_EVENTID event from an
ath9k_htc-managed device before beaconing has been enabled. This causes
a device-by-zero error in the driver, leading to either a crash or an
out of bounds read.

Prevent this by aborting the handling in ath9k_htc_swba() if beacons are
not enabled.

Reported-by: Robert Morris <rtm@csail.mit.edu>
Closes: https://lore.kernel.org/r/88967.1743099372@localhost
Fixes: 832f6a18fc2a ("ath9k_htc: Add beacon slots")
Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
Link: https://patch.msgid.link/20250402112217.58533-1-toke@toke.dk
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/ath/ath9k/htc_drv_beacon.c