[PATCH] wifi: mwifiex: validate scan TLV result arrays

[PATCH] wifi: mwifiex: validate scan TLV result arrays

[Pengpeng Hou]

mwifiex_ret_802_11_scan() indexes TSF and channel-band TLV
arrays by the reported number of BSS result sets.

Ignore TSF or channel-band TLVs whose payload length cannot provide one
entry per reported BSS set.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/net/wireless/marvell/mwifiex/scan.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 97c0ec3b822e..7416756ada3b 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -2165,6 +2165,15 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 					     (struct mwifiex_ie_types_data **)
 					     &chan_band_tlv);
 
+	if (tsf_tlv &&
+	    le16_to_cpu(tsf_tlv->header.len) / TSF_DATA_SIZE <
+	    scan_rsp->number_of_sets)
+		tsf_tlv = NULL;
+	if (chan_band_tlv &&
+	    le16_to_cpu(chan_band_tlv->header.len) /
+	    sizeof(*chan_band_tlv->chan_band_param) < scan_rsp->number_of_sets)
+		chan_band_tlv = NULL;
+
 #ifdef CONFIG_PM
 	if (priv->wdev.wiphy->wowlan_config)
 		nd_config = priv->wdev.wiphy->wowlan_config->nd_config;
-- 
2.43.0

Re: [PATCH] wifi: mwifiex: validate scan TLV result arrays

[Francesco Dolcini]

On Mon, Jul 06, 2026 at 05:26:54PM +0800, Pengpeng Hou wrote:
> mwifiex_ret_802_11_scan() indexes TSF and channel-band TLV
> arrays by the reported number of BSS result sets.
> 
> Ignore TSF or channel-band TLVs whose payload length cannot provide one
> entry per reported BSS set.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

Was this tested?

> ---
>  drivers/net/wireless/marvell/mwifiex/scan.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
> index 97c0ec3b822e..7416756ada3b 100644
> --- a/drivers/net/wireless/marvell/mwifiex/scan.c
> +++ b/drivers/net/wireless/marvell/mwifiex/scan.c
> @@ -2165,6 +2165,15 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
>  					     (struct mwifiex_ie_types_data **)
>  					     &chan_band_tlv);
>  
> +	if (tsf_tlv &&
> +	    le16_to_cpu(tsf_tlv->header.len) / TSF_DATA_SIZE <
> +	    scan_rsp->number_of_sets)
> +		tsf_tlv = NULL;
> +	if (chan_band_tlv &&
> +	    le16_to_cpu(chan_band_tlv->header.len) /
> +	    sizeof(*chan_band_tlv->chan_band_param) < scan_rsp->number_of_sets)
> +		chan_band_tlv = NULL;
> +

If something like that happen we should return an error, and return from
the function

a few lines before we do

	if (scan_rsp->number_of_sets > MWIFIEX_MAX_AP) {
		mwifiex_dbg(adapter, ERROR,
			    "SCAN_RESP: too many AP returned (%d)\n",
			    scan_rsp->number_of_sets);
		ret = -1;
		goto check_next_scan;
	}

why not doing something similar when this buffer from the fw is
corrupted?

Francesco