Commit 59c668d7 authored by Kees Cook's avatar Kees Cook Committed by Kalle Valo
Browse files

mwifiex: Avoid memset() over-write of WEP key_material 



In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memset(), avoid intentionally writing across
neighboring array fields.

When preparing to call mwifiex_set_keyparamset_wep(), key_material is
treated very differently from its structure layout (which has only a
single struct mwifiex_ie_type_key_param_set). Instead, add a new type to
the union so memset() can correctly reason about the size of the
structure.

Note that the union ("params", 196 bytes) containing key_material was
not large enough to hold the target of this memset(): sizeof(struct
mwifiex_ie_type_key_param_set) == 60, NUM_WEP_KEYS = 4, so 240
bytes, or 44 bytes past the end of "params". The good news is that
it appears that the command buffer, as allocated, is 2048 bytes
(MWIFIEX_SIZE_OF_CMD_BUFFER), so no neighboring memory appears to be
getting clobbered.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarBrian Norris <briannorris@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210617171522.3410951-1-keescook@chromium.org
parent 0d5e743d

drivers/net/wireless/marvell/mwifiex/fw.h

+6 −0
Original line number Diff line number Diff line
@@ -995,6 +995,11 @@ struct host_cmd_ds_802_11_key_material { 
	struct mwifiex_ie_type_key_param_set key_param_set;

} __packed;



struct host_cmd_ds_802_11_key_material_wep {

	__le16 action;

	struct mwifiex_ie_type_key_param_set key_param_set[NUM_WEP_KEYS];

} __packed;



struct host_cmd_ds_gen {

	__le16 command;

	__le16 size;
@@ -2347,6 +2352,7 @@ struct host_cmd_ds_command { 
		struct host_cmd_ds_wmm_get_status get_wmm_status;

		struct host_cmd_ds_802_11_key_material key_material;

		struct host_cmd_ds_802_11_key_material_v2 key_material_v2;

		struct host_cmd_ds_802_11_key_material_wep key_material_wep;

		struct host_cmd_ds_version_ext verext;

		struct host_cmd_ds_mgmt_frame_reg reg_mask;

		struct host_cmd_ds_remain_on_chan roc_cfg;

drivers/net/wireless/marvell/mwifiex/sta_cmd.c

+6 −5
Original line number Diff line number Diff line
@@ -840,14 +840,15 @@ mwifiex_cmd_802_11_key_material_v1(struct mwifiex_private *priv, 
	}



	if (!enc_key) {

		memset(&key_material->key_param_set, 0,

		       (NUM_WEP_KEYS *

			sizeof(struct mwifiex_ie_type_key_param_set)));

		struct host_cmd_ds_802_11_key_material_wep *key_material_wep =

			(struct host_cmd_ds_802_11_key_material_wep *)key_material;

		memset(key_material_wep->key_param_set, 0,

		       sizeof(key_material_wep->key_param_set));

		ret = mwifiex_set_keyparamset_wep(priv,

						  &key_material->key_param_set,

						  &key_material_wep->key_param_set[0],

						  &key_param_len);

		cmd->size = cpu_to_le16(key_param_len +

				    sizeof(key_material->action) + S_DS_GEN);

				    sizeof(key_material_wep->action) + S_DS_GEN);

		return ret;

	} else

		memset(&key_material->key_param_set, 0,