ar5413: missing numChannels>0 guard in getGainBoundariesAndPdadcsForPowers causes OOB read and index wrap
Summary
ar5413getGainBoundariesAndPdadcsForPowers at 426-427 calls GetLowerUpperIndex(channel,pRaw->pChannels,pRaw->numChannels,...) WITHOUT checking numChannels>0. Sibling ar5413GetChannelMaxMinPower at 713 DOES check. GetLowerUpperIndex (288-331): ep=lp+listSize; probes ep[-1] (306) no listSize>0 guard; *vlo=*vhi=listSize-1 (307) wraps to 0xFFFFFFFF when listSize==0. Caller deref pRawDataset->pDataPerChannel[idxL] at 432 -> catastrophic OOB read panic. EEPROM parser ah_eeprom_v3.c:460-475 can leave numPiers=0 if first calibration word zero. ar5413SetPowerTable (565-572) unconditionally invokes. Trigger: ifconfig ath0 up/channel scan on system with faulty/malicious AR5413 EEPROM. Deterministic DoS panic. Same pattern in ar2413.c ar2316.c ar2317.c ar2425.c. Fix: if numChannels<1 return 0; GetLowerUpperIndex listSize==0 guard.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1766 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| fix.diff | suggested-fix | Add guard: if numChannels<1 return 0 before GetLowerUpperIndex. | 544 B | view raw |
| VERDICT.md | verdict | full analysis | 1.1 KB | ↓ raw |
DF-1766 — Verdict
Severity: Low Status: REPRODUCED (source-only confirmation — driver/HW-gated, not runtime-triggered on QEMU guest) Impact: panic Confidence: certain
Verdict
REPRODUCED. The cited bug is confirmed real in the audited source at sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:426-427.
Mechanism
ar5413getGainBoundariesAndPdadcsForPowers calls GetLowerUpperIndex without checking numChannels>0; numChannels==0 wraps listSize-1 to 0xFFFFFFFF and derefs pDataPerChannel[idxL] OOB.
Fix
Add guard: if numChannels<1 return 0 before GetLowerUpperIndex.
The full git-apply-able diff is in fix.diff.
Build validation
fix.diff applies cleanly and compiles with -Werror as part of the batch module build
(all 51 fixes applied to /usr/src, kernel+modules built).
Notes
Source-only confirmation: this finding is in a device driver code path that requires specific hardware not present in the QEMU guest. The bug is confirmed by source tracing (cited path:line verified against sys/), and the fix compiles clean. No runtime trigger was attempted as the relevant device/module is HW-gated.
Fix verification
fixedVALIDATED via batch build rc=0.
if_ath.ko built with -Werror (ar5413.c HAL).
Confirmed kernel references
- s
- y
- s
- /
- d
- e
- v
- /
- n
- e
- t
- i
- f
- /
- a
- t
- h
- /
- a
- t
- h
- _
- h
- a
- l
- /
- a
- r
- 5
- 2
- 1
- 2
- /
- a
- r
- 5
- 4
- 1
- 3
- .
- c
- :
- 4
- 2
- 6
- -
- 4
- 2
- 7
Detail
Exploit chain
none
Evidence (decisive lines)
Source traced at sys/dev/netif/ath/ath_hal/ar5212/ar5413.c:426-427. Fix compiled clean.
PoC changes
authored fix.diff: numChannels<1 guard with output param init
Verified recommended fix
Add numChannels<1 guard before GetLowerUpperIndex. Matches finding proposal.
Verdict
REPRODUCED (source-only). GetLowerUpperIndex without numChannels>0 check; numChannels==0 wraps idx to 0xFFFFFFFF, OOB deref.
No comments yet.