In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE<\/p>\n
__hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a
\nsingle tx_buf of MAX_TX_BUF_SIZE (32768) bytes, limiting the batch
\nby record count but never by cumulative byte length.<\/p>\n
With large frames (MTU 2304), 20 aggregated frames of 2292 bytes
\neach exceed the allocation (20 * 2296 = 45920 bytes), so the
\nmemcpy() in the loop writes up to 13152 bytes past tx_buf->buf
\nbefore usb_submit_urb().<\/p>\n
Peek the queue head and stop before copying any record that would
\ncross MAX_TX_BUF_SIZE, then dispatch the current batch. Leftover
\nskbs remain queued and are drained on the next URB completion.<\/p>\n
The byte bound changes the loop’s exit semantics: it can now exit
\nbefore i == tx_skb_cnt – 1. Stock only finalized tx_buf->len on
\nthat last index (len += offset), so an early break would submit a
\nURB holding only the last record’s length while every dequeued skb
\nis freed on completion, silently dropping frames. Make tx_buf->len
\na running total and advance tx_buf->offset per record instead; the
\nstride round_up(nskb->len + 4, 4) is identical to the stock stride
\nwhen the loop runs to completion.<\/p>\n
Tested on hardware with an MTU 2304 flood: the loop stops at
\nrecord 15 (len = 32144, offset = 32144, within 32768), no
\noversized URB is submitted, and MTU 1500 pings pass 20\/20.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE<\/p>\n
__hif_usb_tx() dequeues up to MAX_TX_AGGR_NUM (20) frames into a
\nsingle t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41299","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}