[PATCH wireless 0/3] wifi: mwifiex: firmware response validation fixes

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

Three input validation fixes for the mwifiex driver:

  1/3: The ADDBA response handler uses a 4-bit TID value (0-15) to
       index an 8-entry array. Values >= 8 result in out-of-bounds
       array access.

  2/3: The multichannel event handler uses intf_num from a TLV to
       iterate a flexible array without checking it fits the TLV
       data.

  3/3: The IBSS connected event handler replaces a buffer-bounded
       length with the TLV header length, which may exceed the
       event buffer.

Tristan Madani (3):
  wifi: mwifiex: validate TID in ADDBA response handler
  wifi: mwifiex: validate intf_num in multichannel event handler
  wifi: mwifiex: cap TLV length in IBSS connected event handler

 drivers/net/wireless/marvell/mwifiex/11n.c       | 6 ++++++
 drivers/net/wireless/marvell/mwifiex/sta_event.c  | 6 ++++++
 2 files changed, 12 insertions(+)

-- 
2.47.3