Commit ab1fed0c authored by Pin-yen Lin's avatar Pin-yen Lin Committed by Yongqiang Liu
Browse files

wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet 

stable inclusion
from stable-v5.10.198
commit 10a18c8bac7f60d32b7af22da03b66f350beee38
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95AXH
CVE: CVE-2023-52525

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=10a18c8bac7f60d32b7af22da03b66f350beee38



--------------------------------

[ Upstream commit aef7a030 ]

Only skip the code path trying to access the rfc1042 headers when the
buffer is too small, so the driver can still process packets without
rfc1042 headers.

Fixes: 11958528 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets")
Signed-off-by: default avatarPin-yen Lin <treapking@chromium.org>
Acked-by: default avatarBrian Norris <briannorris@chromium.org>
Reviewed-by: default avatarMatthew Wang <matthewmwang@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230908104308.1546501-1-treapking@chromium.org


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarYongqiang Liu <liuyongqiang13@huawei.com>
parent 70c98c7d

drivers/net/wireless/marvell/mwifiex/sta_rx.c

+9 −7
Original line number Diff line number Diff line
@@ -98,7 +98,8 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, 
	rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length);

	rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off;



	if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) {

	if (sizeof(rx_pkt_hdr->eth803_hdr) + sizeof(rfc1042_header) +

	    rx_pkt_off > skb->len) {

		mwifiex_dbg(priv->adapter, ERROR,

			    "wrong rx packet offset: len=%d, rx_pkt_off=%d\n",

			    skb->len, rx_pkt_off);
@@ -107,12 +108,13 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv, 
		return -1;

	}



	if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,

	if (sizeof(*rx_pkt_hdr) + rx_pkt_off <= skb->len &&

	    ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,

		      sizeof(bridge_tunnel_header))) ||

	     (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,

		      sizeof(rfc1042_header)) &&

	      ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP &&

	     ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX)) {

	      ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX))) {

		/*

		 *  Replace the 803 header and rfc1042 header (llc/snap) with an

		 *    EthernetII header, keep the src/dst and snap_type