Commit d5a93b7d authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Kalle Valo
Browse files

wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len 



Add sanity checks for both `tlv_len` and `tlv_bitmap_len` before
decoding data from `event_buf`.

This prevents any malicious or buggy firmware from overflowing
`event_buf` through large values for `tlv_len` and `tlv_bitmap_len`.

Suggested-by: default avatarDan Williams <dcbw@redhat.com>
Signed-off-by: default avatarGustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/d4f8780527d551552ee96f17a0229e02e1c200d1.1692931954.git.gustavoars@kernel.org
parent c7847241

drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c

+16 −0
Original line number Diff line number Diff line
@@ -921,6 +921,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv, 
	while (tlv_buf_left > sizeof(*tlv_rxba)) {

		tlv_type = le16_to_cpu(tlv_rxba->header.type);

		tlv_len  = le16_to_cpu(tlv_rxba->header.len);

		if (size_add(sizeof(tlv_rxba->header), tlv_len) > tlv_buf_left) {

			mwifiex_dbg(priv->adapter, WARN,

				    "TLV size (%zu) overflows event_buf buf_left=%d\n",

				    size_add(sizeof(tlv_rxba->header), tlv_len),

				    tlv_buf_left);

			return;

		}



		if (tlv_type != TLV_TYPE_RXBA_SYNC) {

			mwifiex_dbg(priv->adapter, ERROR,

				    "Wrong TLV id=0x%x\n", tlv_type);
@@ -929,6 +937,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv, 


		tlv_seq_num = le16_to_cpu(tlv_rxba->seq_num);

		tlv_bitmap_len = le16_to_cpu(tlv_rxba->bitmap_len);

		if (size_add(sizeof(*tlv_rxba), tlv_bitmap_len) > tlv_buf_left) {

			mwifiex_dbg(priv->adapter, WARN,

				    "TLV size (%zu) overflows event_buf buf_left=%d\n",

				    size_add(sizeof(*tlv_rxba), tlv_bitmap_len),

				    tlv_buf_left);

			return;

		}



		mwifiex_dbg(priv->adapter, INFO,

			    "%pM tid=%d seq_num=%d bitmap_len=%d\n",

			    tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,