From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793207659; b=0OWXhrBLYzOeZOITokPzMishoPQ92eOwTqiTi8XqP8l1SCPC7IbUE1U3yjkqFt5KBO+u dVpweoHC4Kg5hncbHi0vXhJwwEtIEHE0xY3YYFJrVFkR9Ili7aQkhZZRSTtd21c8Su3GQ v3uxMxsDwkZd/pC/Oxs3qPSRtXn4DgaUmk22nxlvb7XibFZTetOgimX1jYl8WP9jUe6Vr 1HGZLnfQDk57Ms+0CsVzOZOEaJt4yab6x1v6S2UAIQj2diR7aiddkT6d4823ulSv+bhPz XR2nnNtad2g2l01K/k5kJb0RofM1rHZhlJIZ164SbTxcCxfV314xfXdYAbOEwZ+vlPg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793207659; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=thH920lBvIkPjCb2vc/waJXRzLHDrnhI63jyzqLYj+k=; b=CKk/ufWk5YBSvTkidNQvTbvvFxe0OLYkXOGv3299YV0PG9Zl9rygNLQ7rmWmZj8eAadZ tzqKb0CjprA7i8X62eTJyyyyDsLfO1M53VhN7ZMww1gFYlKrQb5qzXifZFZJkU8LlvO9v 61+igjNTsyxPYQH1W1GQNQprfrxFkhpXOQc5tvL5ouFQaFXToLUiY9cvCtypwmkeYpOlc 1CEqC6fZwj9Zk8kKYEIr85r7lRAsb8Dri6M6Lvf5vVCWxQRFkZ6gVJGQ++JEpJOSu245B XWUQktqjUIUlRC3AblwRLh6XzDS/eylGBOmcA1yPvmEEYO/AXUv5B2hKFdKjUujfZmQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Ha2NHFjn; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4030F606A31A; Wed, 28 Oct 2026 17:14:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Ha2NHFjn Received: by smtp.kernel.org (Postfix) with ESMTPSA id 90DDB1F01825; Wed, 28 Oct 2026 17:14:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793207659; bh=thH920lBvIkPjCb2vc/waJXRzLHDrnhI63jyzqLYj+k=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Ha2NHFjnacPitXj46YWheBQgqSB3yvh38VNBuBE6oyDHFLGDDfjKXg3diPWPpTrKE 4LOvVbdkJt0vdw5cei0Vr29jgyOXCUnGKs5iSMyFq/x+x6HwinyszqB3bdxOa8yHVB vgpOF3LH4q/bhGJ7FgqcvD8o0/a23Nzk/Fr1/zsY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Heyang Tan , Christian Lamparter , Johannes Berg Subject: [PATCH 6.12 095/247] wifi: p54: validate firmware record lengths Date: Wed, 28 Oct 2026 17:58:18 +0100 Message-ID: <20261028165949.644473510@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028165947.349197979@linuxfoundation.org> References: <20261028165947.349197979@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Heyang Tan commit db7b86bd97b380ece8fa39cfdd7502a9fd35e56f upstream. The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record. Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length found in the supported firmware images. Reject descriptor values that underflow the RX offset or produce an empty RX range before updating the driver state. Assisted-by: LLM Codex Signed-off-by: Heyang Tan Tested-by: Christian Lamparter Link: https://patch.msgid.link/20260918083349.891-1-thy15333007817@163.com Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/intersil/p54/fwio.c | 42 +++++++++++++++++++++++++++---- 1 file changed, 37 insertions(+), 5 deletions(-) --- a/drivers/net/wireless/intersil/p54/fwio.c +++ b/drivers/net/wireless/intersil/p54/fwio.c @@ -52,6 +52,13 @@ int p54_parse_firmware(struct ieee80211_ u32 code = le32_to_cpu(bootrec->code); switch (code) { case BR_CODE_COMPONENT_ID: + if (len < sizeof(struct bootrec_comp_id) / + sizeof(*bootrec->data)) { + wiphy_err(priv->hw->wiphy, + "firmware component ID is too short\n"); + return -EINVAL; + } + priv->fw_interface = be32_to_cpup((__be32 *) bootrec->data); switch (priv->fw_interface) { @@ -72,16 +79,41 @@ int p54_parse_firmware(struct ieee80211_ } break; case BR_CODE_COMPONENT_VERSION: + if (len < DIV_ROUND_UP(sizeof(struct bootrec_comp_ver), + sizeof(*bootrec->data))) { + wiphy_err(priv->hw->wiphy, + "firmware component version is too short\n"); + return -EINVAL; + } + /* 24 bytes should be enough for all firmwares */ - if (strnlen((unsigned char *) bootrec->data, 24) < 24) - fw_version = (unsigned char *) bootrec->data; + if (strnlen((unsigned char *)bootrec->data, + sizeof(struct bootrec_comp_ver)) < + sizeof(struct bootrec_comp_ver)) + fw_version = (unsigned char *)bootrec->data; break; case BR_CODE_DESCR: { struct bootrec_desc *desc = (struct bootrec_desc *)bootrec->data; - priv->rx_start = le32_to_cpu(desc->rx_start); - /* FIXME add sanity checking */ - priv->rx_end = le32_to_cpu(desc->rx_end) - 0x3500; + u32 rx_start, rx_end; + + /* 0xa is the shortest descriptor in supported firmware. */ + if (len < 0xa) { + wiphy_err(priv->hw->wiphy, + "firmware descriptor is too short\n"); + return -EINVAL; + } + + rx_start = le32_to_cpu(desc->rx_start); + rx_end = le32_to_cpu(desc->rx_end); + if (rx_end < 0x3500 || rx_end - 0x3500 <= rx_start) { + wiphy_err(priv->hw->wiphy, + "firmware descriptor has invalid RX range\n"); + return -EINVAL; + } + + priv->rx_start = rx_start; + priv->rx_end = rx_end - 0x3500; priv->headroom = desc->headroom; priv->tailroom = desc->tailroom; priv->privacy_caps = desc->privacy_caps;