* [PATCH] wifi: rtw89: cap firmware section_num before parsing
@ 2026-08-22 8:00 Laxman Acharya Padhya
2026-08-25 3:54 ` Ping-Ke Shih
0 siblings, 1 reply; 3+ messages in thread
From: Laxman Acharya Padhya @ 2026-08-22 8:00 UTC (permalink / raw)
To: Ping-Ke Shih, linux-wireless; +Cc: linux-kernel, stable
rtw89_fw_bin_info.section_info has FWDL_SECTION_MAX_NUM (10) entries.
The v0/v1 header parsers take section_num from an 8-bit firmware field
(0..255) and write info->section_info[i] with no cap.
rtw89_fw_download_suit() keeps that object on the stack, so a crafted
firmware blob overflows the stack.
Reject a truncated header and a section table that does not fit in the
firmware image before reading fw_hdr->sections[i].
Cc: stable@vger.kernel.org
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
---
drivers/net/wireless/realtek/rtw89/fw.c | 30 +++++++++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 0099c5c03e7a6..57d4252ee78f0 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -156,8 +156,23 @@ static int rtw89_fw_hdr_parser_v0(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
if (!info)
return -EINVAL;
+ if (len < sizeof(*fw_hdr)) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_W6_SEC_NUM);
+ if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+ rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+ info->section_num);
+ return -EINVAL;
+ }
+
base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+ if (base_hdr_len > len) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_W7_DYN_HDR);
info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_W7_IDMEM_SHARE_MODE);
@@ -455,9 +470,24 @@ static int rtw89_fw_hdr_parser_v1(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
int ret;
u32 i;
+ if (len < sizeof(*fw_hdr)) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_SEC_NUM);
+ if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+ rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+ info->section_num);
+ return -EINVAL;
+ }
+
info->dsp_checksum = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_DSP_CHKSUM);
base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+ if (base_hdr_len > len) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_DYN_HDR);
info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_IDMEM_SHARE_MODE);
--
2.51.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* RE: [PATCH] wifi: rtw89: cap firmware section_num before parsing
2026-08-22 8:00 [PATCH] wifi: rtw89: cap firmware section_num before parsing Laxman Acharya Padhya
@ 2026-08-25 3:54 ` Ping-Ke Shih
2026-08-25 17:44 ` [PATCH v2] " Laxman Acharya Padhya
0 siblings, 1 reply; 3+ messages in thread
From: Ping-Ke Shih @ 2026-08-25 3:54 UTC (permalink / raw)
To: Laxman Acharya Padhya, linux-wireless@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Laxman Acharya Padhya <acharyalaxman8848@gmail.com> wrote:
> rtw89_fw_bin_info.section_info has FWDL_SECTION_MAX_NUM (10) entries.
> The v0/v1 header parsers take section_num from an 8-bit firmware field
> (0..255) and write info->section_info[i] with no cap.
> rtw89_fw_download_suit() keeps that object on the stack, so a crafted
> firmware blob overflows the stack.
>
> Reject a truncated header and a section table that does not fit in the
> firmware image before reading fw_hdr->sections[i].
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Logic is good to me, but please add empty lines.
> ---
> drivers/net/wireless/realtek/rtw89/fw.c | 30 +++++++++++++++++++++++++
> 1 file changed, 30 insertions(+)
>
> diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
> index 0099c5c03e7a6..57d4252ee78f0 100644
> --- a/drivers/net/wireless/realtek/rtw89/fw.c
> +++ b/drivers/net/wireless/realtek/rtw89/fw.c
> @@ -156,8 +156,23 @@ static int rtw89_fw_hdr_parser_v0(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
> if (!info)
> return -EINVAL;
>
> + if (len < sizeof(*fw_hdr)) {
> + rtw89_err(rtwdev, "[ERR]fw header truncated\n");
> + return -EINVAL;
> + }
> +
> info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_W6_SEC_NUM);
> + if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
> + rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
> + info->section_num);
> + return -EINVAL;
> + }
> +
> base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
> + if (base_hdr_len > len) {
> + rtw89_err(rtwdev, "[ERR]fw header truncated\n");
> + return -EINVAL;
> + }
an empty line
> info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_W7_DYN_HDR);
> info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_W7_IDMEM_SHARE_MODE);
>
> @@ -455,9 +470,24 @@ static int rtw89_fw_hdr_parser_v1(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
> int ret;
> u32 i;
>
> + if (len < sizeof(*fw_hdr)) {
> + rtw89_err(rtwdev, "[ERR]fw header truncated\n");
> + return -EINVAL;
> + }
> +
> info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_SEC_NUM);
> + if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
> + rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
> + info->section_num);
> + return -EINVAL;
> + }
> +
> info->dsp_checksum = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_DSP_CHKSUM);
> base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
> + if (base_hdr_len > len) {
> + rtw89_err(rtwdev, "[ERR]fw header truncated\n");
> + return -EINVAL;
> + }
an empty line
> info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_DYN_HDR);
> info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_IDMEM_SHARE_MODE);
>
> --
> 2.51.2
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH v2] wifi: rtw89: cap firmware section_num before parsing
2026-08-25 3:54 ` Ping-Ke Shih
@ 2026-08-25 17:44 ` Laxman Acharya Padhya
0 siblings, 0 replies; 3+ messages in thread
From: Laxman Acharya Padhya @ 2026-08-25 17:44 UTC (permalink / raw)
To: Ping-Ke Shih, linux-wireless; +Cc: Kalle Valo, linux-kernel, stable
rtw89_fw_bin_info.section_info has FWDL_SECTION_MAX_NUM (10) entries.
The v0/v1 header parsers take section_num from an 8-bit firmware field
(0..255) and write info->section_info[i] with no cap.
rtw89_fw_download_suit() keeps that object on the stack, so a crafted
firmware blob overflows the stack.
Reject a truncated header and a section table that does not fit in the
firmware image before reading fw_hdr->sections[i].
Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
Cc: stable@vger.kernel.org
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@gmail.com>
---
Changes in v2:
- Add the requested empty lines after the section table bounds checks.
- Add the missing Fixes tag and Ping-Ke's Acked-by tag.
drivers/net/wireless/realtek/rtw89/fw.c | 32 +++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c
index 0099c5c03e7a..b2991bc93f85 100644
--- a/drivers/net/wireless/realtek/rtw89/fw.c
+++ b/drivers/net/wireless/realtek/rtw89/fw.c
@@ -156,8 +156,24 @@ static int rtw89_fw_hdr_parser_v0(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
if (!info)
return -EINVAL;
+ if (len < sizeof(*fw_hdr)) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_W6_SEC_NUM);
+ if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+ rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+ info->section_num);
+ return -EINVAL;
+ }
+
base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+ if (base_hdr_len > len) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_W7_DYN_HDR);
info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_W7_IDMEM_SHARE_MODE);
@@ -455,9 +471,25 @@ static int rtw89_fw_hdr_parser_v1(struct rtw89_dev *rtwdev, const u8 *fw, u32 le
int ret;
u32 i;
+ if (len < sizeof(*fw_hdr)) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_SEC_NUM);
+ if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) {
+ rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n",
+ info->section_num);
+ return -EINVAL;
+ }
+
info->dsp_checksum = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_DSP_CHKSUM);
base_hdr_len = struct_size(fw_hdr, sections, info->section_num);
+ if (base_hdr_len > len) {
+ rtw89_err(rtwdev, "[ERR]fw header truncated\n");
+ return -EINVAL;
+ }
+
info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_DYN_HDR);
info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_IDMEM_SHARE_MODE);
--
2.51.2
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-08-25 17:44 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-22 8:00 [PATCH] wifi: rtw89: cap firmware section_num before parsing Laxman Acharya Padhya
2026-08-25 3:54 ` Ping-Ke Shih
2026-08-25 17:44 ` [PATCH v2] " Laxman Acharya Padhya
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox