From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08DD8C3DA66 for ; Fri, 25 Aug 2023 03:17:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229900AbjHYDRM (ORCPT ); Thu, 24 Aug 2023 23:17:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37860 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238875AbjHYDRB (ORCPT ); Thu, 24 Aug 2023 23:17:01 -0400 Received: from omta034.useast.a.cloudfilter.net (omta034.useast.a.cloudfilter.net [44.202.169.33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9572B210A for ; Thu, 24 Aug 2023 20:16:28 -0700 (PDT) Received: from eig-obgw-6001a.ext.cloudfilter.net ([10.0.30.140]) by cmsmtp with ESMTP id ZBoKquEJeez0CZNIUqMJjJ; Fri, 25 Aug 2023 03:15:42 +0000 Received: from gator4166.hostgator.com ([108.167.133.22]) by cmsmtp with ESMTPS id ZNIjqKxelWs6SZNIjqYIGy; Fri, 25 Aug 2023 03:15:57 +0000 X-Authority-Analysis: v=2.4 cv=Sb7ky9du c=1 sm=1 tr=0 ts=64e81ced a=1YbLdUo/zbTtOZ3uB5T3HA==:117 a=WzbPXH4gqzPVN0x6HrNMNA==:17 a=OWjo9vPv0XrRhIrVQ50Ab3nP57M=:19 a=dLZJa+xiwSxG16/P+YVxDGlgEgI=:19 a=CGo6wCm4IADRok0f:21 a=IkcTkHD0fZMA:10 a=UttIx32zK-AA:10 a=wYkD_t78qR0A:10 a=VwQbUJbxAAAA:8 a=rBWVdRCEoVSWMRuK3c8A:9 a=QEXdDO2ut3YA:10 a=AjGcO6oz07-iQ99wixmX:22 a=tNK2v2ls7fuFGmW9SST8:22 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=embeddedor.com; s=default; h=Content-Transfer-Encoding:Content-Type: In-Reply-To:From:References:Cc:To:Subject:MIME-Version:Date:Message-ID:Sender :Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help: List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=r7reQxyz3ksflfd/iSGFdMwfQPU24M66IYQoOYv0eUI=; b=Lds0zeFshaxWEbSK2uHaRLRFZA bOe0acyvaHjorj9dPxHaEAeMneDC/yURVVMAXEMlAmA5sN+Y+NOOkeldLp2pvICtEn+KpM+80v2Iq kmg5rDlDnKRRro4wcw/W4qSmxjSoJh676Q4EYX0HzxOmxzqWPbmJnwxw6kTHqoTBlXixRdkT5fcY2 kIouLvLDvo3mVWtLEvg+R0kB6DhP7g7HVkAZvojz4jpz7PpOCS4uR56ivR1JR5F8itPthdhIrMRS1 DsdTPiJnQC1bewiMf4Tyl8eMF4M6Huj26pHrfFckomMN0FUJnJC4CLBRXAqRcJlIiDqKnePHkGwv4 nq16RbPg==; Received: from 187-162-21-192.static.axtel.net ([187.162.21.192]:42040 helo=[192.168.15.8]) by gator4166.hostgator.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from ) id 1qZNIi-003pg7-2g; Thu, 24 Aug 2023 22:15:56 -0500 Message-ID: Date: Thu, 24 Aug 2023 21:16:58 -0600 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.13.0 Subject: Re: [RFC] wifi: mwifiex: Asking for some light on this, please :) Content-Language: en-US To: Dan Williams , Brian Norris , Kalle Valo Cc: linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org, "Gustavo A. R. Silva" , linux-hardening@vger.kernel.org References: <6e3fddfe-2d31-72fa-ac2b-3b7fa4e6fe08@embeddedor.com> <3837e9ad-4d3b-40ae-a2f8-a051973ca3e5@embeddedor.com> <8e54e07eb0505302d601fd923e6cf0af0d60ff82.camel@redhat.com> From: "Gustavo A. R. Silva" In-Reply-To: <8e54e07eb0505302d601fd923e6cf0af0d60ff82.camel@redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 187.162.21.192 X-Source-L: No X-Exim-ID: 1qZNIi-003pg7-2g X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: 187-162-21-192.static.axtel.net ([192.168.15.8]) [187.162.21.192]:42040 X-Source-Auth: gustavo@embeddedor.com X-Email-Count: 1 X-Org: HG=hgshared;ORG=hostgator; X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= X-Local-Domain: yes X-CMAE-Envelope: MS4xfBJwK+99nGvr9o+yZiXSSR5k6P8pws/f/wmAI21iL04dUrrOnotDTCvpaX/ZRx+7ycLuCwGRfDe9GXkARIZWa1qwnrteJrHnjTIWMXDUQXuSB5xvoTSz vcHVXaJSng4FV01ZZgYXALw+veuZNSOUao78In1opflCbwbCY26R4dFVzx+4H1ttqxdIM2synJlz4GLHUd6t9G9a0eiowhfCwgrU+hUrRtURZY/aN9BMtjpm Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org > Make the mwifiex_dbg() into a warning though. This is an error > condition and shouldn't be hidden. > >>                  mwifiex_dbg(priv->adapter, INFO, >>                              "%pM tid=%d seq_num=%d bitmap_len=%d\n", >>                              tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num, >> >> I wanted to used `sizeof(*tlv_rxba) + tlv_bitmap_len` here instead of >> `sizeof(tlv_rxba->header) + tlv_len` to avoid any issues in case there >> is any (buggy) discrepancy between `tlv_len` and `tlv_bitmap_len`. >> This is when for some (weird) reason >>         `tlv_len - (sizeof(*tlv_rxba) - sizeof(tlv_rxba->header)) != tlv_bitmap_len` > > tlv_len absolutely should also be checked. But you don't need that > condition, just do the same thing right after tlv_len is retrieved from > the header: > > if (sizeof(tlv_rxba->header) + tlv_len > tlv_buf_left) { > > return; > } > Thanks for all the feedback, Dan: https://lore.kernel.org/linux-hardening/cover.1692931954.git.gustavoars@kernel.org/ -- Gustavo