[PATCH] wifi: mwifiex: validate rate scope TLV length

[PATCH] wifi: mwifiex: validate rate scope TLV length

[Pengpeng Hou]

From: Pengpeng <pengpeng@iscas.ac.cn>

mwifiex_ret_tx_rate_cfg() verifies that a TLV stays within the command
response, then parses RATE_SCOPE as struct mwifiex_rate_scope. The
type-specific parser also needs to prove that the declared TLV payload
covers the bitmap fields that it reads.

Check the RATE_SCOPE payload length before copying the legacy bitmaps,
and require the VHT bitmap area only for firmware API version 15 where
it is consumed.

Signed-off-by: Pengpeng <pengpeng@iscas.ac.cn>
---
 drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
index 85512f526c5f..5b7399038d5d 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
@@ -260,6 +260,7 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
 	struct mwifiex_rate_scope *rate_scope;
 	struct mwifiex_ie_types_header *head;
 	u16 tlv, tlv_buf_len, tlv_buf_left;
+	size_t rate_scope_len;
 	u8 *tlv_buf;
 	u32 i;
 
@@ -276,6 +277,14 @@ static int mwifiex_ret_tx_rate_cfg(struct mwifiex_private *priv,
 
 		switch (tlv) {
 		case TLV_TYPE_RATE_SCOPE:
+			rate_scope_len = offsetof(struct mwifiex_rate_scope,
+						  vht_mcs_rate_bitmap) - sizeof(*head);
+			if (priv->adapter->fw_api_ver == MWIFIEX_FW_V15)
+				rate_scope_len = sizeof(*rate_scope) - sizeof(*head);
+
+			if (tlv_buf_len < rate_scope_len)
+				break;
+
 			rate_scope = (struct mwifiex_rate_scope *) tlv_buf;
 			priv->bitmap_rates[0] =
 				le16_to_cpu(rate_scope->hr_dsss_rate_bitmap);
-- 
2.43.0

Re: [PATCH] wifi: mwifiex: validate rate scope TLV length

[Francesco Dolcini]

On Mon, Jul 06, 2026 at 05:13:46PM +0800, Pengpeng Hou wrote:
> From: Pengpeng <pengpeng@iscas.ac.cn>
> 
> mwifiex_ret_tx_rate_cfg() verifies that a TLV stays within the command
> response, then parses RATE_SCOPE as struct mwifiex_rate_scope. The
> type-specific parser also needs to prove that the declared TLV payload
> covers the bitmap fields that it reads.
> 
> Check the RATE_SCOPE payload length before copying the legacy bitmaps,
> and require the VHT bitmap area only for firmware API version 15 where
> it is consumed.
> 
> Signed-off-by: Pengpeng <pengpeng@iscas.ac.cn>

Is this change tested? On which device? How?

Francesco