[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAFhGd8rcOPk3RHGhhvFu7=qRTY-hRrdWriwY3h_tiAyL+YnvGg@mail.gmail.com>
Date: Wed, 23 Aug 2023 15:38:57 -0700
From: Justin Stitt <justinstitt@...gle.com>
To: "Gustavo A. R. Silva" <gustavoars@...nel.org>
Cc: Brian Norris <briannorris@...omium.org>,
Kalle Valo <kvalo@...nel.org>,
Amitkumar Karwar <akarwar@...vell.com>,
Xinming Hu <huxm@...vell.com>, Dan Williams <dcbw@...hat.com>,
linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-hardening@...r.kernel.org
Subject: Re: [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
On Wed, Aug 23, 2023 at 3:33 PM Gustavo A. R. Silva
<gustavoars@...nel.org> wrote:
>
> Add sanity checks for both `tlv_len` and `tlv_bitmap_len` before
> decoding data from `event_buf`.
>
> This prevents any malicious or buggy firmware from overflowing
> `event_buf` through large values for `tlv_len` or `tlv_bitmap_len`.
>
> Suggested-by: Dan Williams <dcbw@...hat.com>
> Signed-off-by: Gustavo A. R. Silva <gustavoars@...nel.org>
Reviewed-by: Justin Stitt <justinstitt@...gle.com>
> ---
> .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> index 735aac52bdc4..9ee3b9f1e9ce 100644
> --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> @@ -921,6 +921,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
> while (tlv_buf_left > sizeof(*tlv_rxba)) {
> tlv_type = le16_to_cpu(tlv_rxba->header.type);
> tlv_len = le16_to_cpu(tlv_rxba->header.len);
> + if (size_add(sizeof(tlv_rxba->header), tlv_len) > tlv_buf_left) {
> + mwifiex_dbg(priv->adapter, WARN,
> + "TLV size (%ld) overflows event_buf (%d)\n",
> + size_add(sizeof(tlv_rxba->header), tlv_len),
> + tlv_buf_left);
> + return;
> + }
> +
> if (tlv_type != TLV_TYPE_RXBA_SYNC) {
> mwifiex_dbg(priv->adapter, ERROR,
> "Wrong TLV id=0x%x\n", tlv_type);
> @@ -929,6 +937,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
>
> tlv_seq_num = le16_to_cpu(tlv_rxba->seq_num);
> tlv_bitmap_len = le16_to_cpu(tlv_rxba->bitmap_len);
> + if (size_add(sizeof(*tlv_rxba), tlv_bitmap_len) > tlv_buf_left) {
> + mwifiex_dbg(priv->adapter, WARN,
> + "TLV size (%ld) overflows event_buf (%d)\n",
> + size_add(sizeof(*tlv_rxba), tlv_bitmap_len),
> + tlv_buf_left);
> + return;
> + }
> +
> mwifiex_dbg(priv->adapter, INFO,
> "%pM tid=%d seq_num=%d bitmap_len=%d\n",
> tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,
> --
> 2.34.1
>
Powered by blists - more mailing lists