linux-kernel - [PATCH 25/31] wifi: mwifiex: return error on unexpected bss

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240820-mwifiex-cleanup-v1-25-320d8de4a4b7@pengutronix.de>
Date: Tue, 20 Aug 2024 13:55:50 +0200
From: Sascha Hauer <s.hauer@...gutronix.de>
To: Brian Norris <briannorris@...omium.org>, 
 Francesco Dolcini <francesco@...cini.it>, Kalle Valo <kvalo@...nel.org>
Cc: linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org, 
 kernel@...gutronix.de, Sascha Hauer <s.hauer@...gutronix.de>
Subject: [PATCH 25/31] wifi: mwifiex: return error on unexpected bss_num

When we receive an event, command response or RX packet on with a
bss_num we haven't sent then it must be a driver or firmware bug. It
makes no sense to continue with an arbitrary bss in this case, so print
an error message and bail out with an error.

Signed-off-by: Sascha Hauer <s.hauer@...gutronix.de>
---
 drivers/net/wireless/marvell/mwifiex/cmdevt.c | 15 +++++++++++----
 drivers/net/wireless/marvell/mwifiex/txrx.c   |  6 ++----
 2 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
index 400f1785d0d9e..410e548fab074 100644
--- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
@@ -497,8 +497,11 @@ int mwifiex_process_event(struct mwifiex_adapter *adapter)
 
 	/* Get BSS number and corresponding priv */
 	priv = mwifiex_get_priv_by_id(adapter, EVENT_GET_BSS_NUM(eventcause));
-	if (!priv)
-		priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+	if (!priv) {
+		mwifiex_dbg(adapter, ERROR, "received event on unused bss_num %d\n",
+			    EVENT_GET_BSS_NUM(eventcause));
+		return -EINVAL;
+	}
 
 	/* Clear BSS_NO_BITS from event */
 	eventcause &= EVENT_ID_MASK;
@@ -861,8 +864,12 @@ int mwifiex_process_cmdresp(struct mwifiex_adapter *adapter)
 	/* Get BSS number and corresponding priv */
 	priv = mwifiex_get_priv_by_id(adapter,
 			     HostCmd_GET_BSS_NO(le16_to_cpu(resp->seq_num)));
-	if (!priv)
-		priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
+	if (!priv) {
+		mwifiex_dbg(adapter, ERROR, "received event on unused bss_num %d\n",
+			    HostCmd_GET_BSS_NO(le16_to_cpu(resp->seq_num)));
+		return -EINVAL;
+	}
+
 	/* Clear RET_BIT from HostCmd */
 	resp->command = cpu_to_le16(orig_cmdresp_no & HostCmd_CMD_ID_MASK);
 
diff --git a/drivers/net/wireless/marvell/mwifiex/txrx.c b/drivers/net/wireless/marvell/mwifiex/txrx.c
index 21cfee3290377..0e5247bd642b6 100644
--- a/drivers/net/wireless/marvell/mwifiex/txrx.c
+++ b/drivers/net/wireless/marvell/mwifiex/txrx.c
@@ -32,12 +32,10 @@ int mwifiex_handle_rx_packet(struct mwifiex_adapter *adapter,
 	local_rx_pd = (struct rxpd *) (skb->data);
 	/* Get the BSS number from rxpd, get corresponding priv */
 	priv = mwifiex_get_priv_by_id(adapter, local_rx_pd->bss_num & BSS_NUM_MASK);
-	if (!priv)
-		priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
-
 	if (!priv) {
 		mwifiex_dbg(adapter, ERROR,
-			    "data: priv not found. Drop RX packet\n");
+			    "data: recived RX packet on unused bss_num %d. Dropping it\n",
+			    local_rx_pd->bss_num & BSS_NUM_MASK);
 		dev_kfree_skb_any(skb);
 		return -1;
 	}

-- 
2.39.2