The fix for CVE-2024-53156 (commit 8619593634cb ("wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()")) added a bounds check for conn_rsp_epid in htc_connect_service() to prevent out-of-bounds array access. However, htc_issue_send() accesses target->endpoint[epid] directly without validating the epid parameter. While htc_connect_service() now validates the endpoint ID before storing it, htc_issue_send() can still receive invalid epid values from callers such as htc_send() and htc_send_epid(). This provides defense-in-depth against out-of-bounds access. Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Aleksandr Nesterenko --- drivers/net/wireless/ath/ath9k/htc_hst.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c index 00dc97ac53b9..7821a31c0abb 100644 --- a/drivers/net/wireless/ath/ath9k/htc_hst.c +++ b/drivers/net/wireless/ath/ath9k/htc_hst.c @@ -23,9 +23,16 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb, { struct htc_frame_hdr *hdr; - struct htc_endpoint *endpoint = &target->endpoint[epid]; + struct htc_endpoint *endpoint; int status; + if (epid >= ENDPOINT_MAX) { + kfree_skb(skb); + return -EINVAL; + } + + endpoint = &target->endpoint[epid]; + hdr = skb_push(skb, sizeof(struct htc_frame_hdr)); hdr->endpoint_id = epid; hdr->flags = flags; -- 2.34.1