linux-kernel - Re: [RFC] wifi: mwifiex: Asking for some light on this, please :)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <fd700d21-aed7-ded0-1841-732aca570ef0@embeddedor.com>
Date:   Thu, 24 Aug 2023 21:16:58 -0600
From:   "Gustavo A. R. Silva" <gustavo@...eddedor.com>
To:     Dan Williams <dcbw@...hat.com>,
        Brian Norris <briannorris@...omium.org>,
        Kalle Valo <kvalo@...nel.org>
Cc:     linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        linux-hardening@...r.kernel.org
Subject: Re: [RFC] wifi: mwifiex: Asking for some light on this, please :)



> Make the mwifiex_dbg() into a warning though. This is an error
> condition and shouldn't be hidden.
> 
>>                   mwifiex_dbg(priv->adapter, INFO,
>>                               "%pM tid=%d seq_num=%d bitmap_len=%d\n",
>>                               tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,
>>
>> I wanted to used `sizeof(*tlv_rxba) + tlv_bitmap_len` here instead of
>> `sizeof(tlv_rxba->header) + tlv_len` to avoid any issues in case there
>> is any (buggy) discrepancy between `tlv_len` and `tlv_bitmap_len`.
>> This is when for some (weird) reason
>>          `tlv_len - (sizeof(*tlv_rxba) - sizeof(tlv_rxba->header)) != tlv_bitmap_len`
> 
> tlv_len absolutely should also be checked. But you don't need that
> condition, just do the same thing right after tlv_len is retrieved from
> the header:
> 
> if (sizeof(tlv_rxba->header) + tlv_len > tlv_buf_left) {
>      <warn>
>      return;
> }
> 

Thanks for all the feedback, Dan:

https://lore.kernel.org/linux-hardening/cover.1692931954.git.gustavoars@kernel.org/

--
Gustavo