[PATCH wireless 0/3] wifi: mwifiex: firmware response validation fixes

[PATCH wireless 0/3] wifi: mwifiex: firmware response validation fixes

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

Three input validation fixes for the mwifiex driver:

  1/3: The ADDBA response handler uses a 4-bit TID value (0-15) to
       index an 8-entry array. Values >= 8 result in out-of-bounds
       array access.

  2/3: The multichannel event handler uses intf_num from a TLV to
       iterate a flexible array without checking it fits the TLV
       data.

  3/3: The IBSS connected event handler replaces a buffer-bounded
       length with the TLV header length, which may exceed the
       event buffer.

Tristan Madani (3):
  wifi: mwifiex: validate TID in ADDBA response handler
  wifi: mwifiex: validate intf_num in multichannel event handler
  wifi: mwifiex: cap TLV length in IBSS connected event handler

 drivers/net/wireless/marvell/mwifiex/11n.c       | 6 ++++++
 drivers/net/wireless/marvell/mwifiex/sta_event.c  | 6 ++++++
 2 files changed, 12 insertions(+)

-- 
2.47.3

[PATCH wireless 1/3] wifi: mwifiex: validate TID in ADDBA response handler

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

The TID value extracted from the Block Ack parameter set is a 4-bit
field (0-15), but aggr_prio_tbl[] has only MAX_NUM_TID (8) entries.
A value >= 8 causes an out-of-bounds array access.

Add a bounds check after extracting the TID.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/marvell/mwifiex/11n.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
index cef8a55427dd01..7d249508e1a38d 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n.c
@@ -154,6 +154,12 @@ int mwifiex_ret_11n_addba_req(struct mwifiex_private *priv,
 	tid = (block_ack_param_set & IEEE80211_ADDBA_PARAM_TID_MASK)
 	       >> BLOCKACKPARAM_TID_POS;
 
+	if (tid >= MAX_NUM_TID) {
+		mwifiex_dbg(priv->adapter, ERROR,
+			    "ADDBA RSP: invalid tid %d\n", tid);
+		return -EINVAL;
+	}
+
 	tid_down = mwifiex_wmm_downgrade_tid(priv, tid);
 	ra_list = mwifiex_wmm_get_ralist_node(priv, tid_down, add_ba_rsp->
 		peer_mac_addr);
-- 
2.47.3

[PATCH wireless 2/3] wifi: mwifiex: validate intf_num in multichannel event handler

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

The intf_num field from the multichannel group info TLV indexes the
flexible array bss_type_numlist[] without checking whether it fits
the TLV data. An intf_num larger than the available data causes reads
past the TLV boundary.

Add a check that intf_num does not exceed the number of entries that
fit in the TLV data.

Fixes: 8d6b538a5eac ("mwifiex: handle multichannel event")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/marvell/mwifiex/sta_event.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_event.c b/drivers/net/wireless/marvell/mwifiex/sta_event.c
index fecd88967ceb84..1f746e8f6b3e18 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
@@ -450,6 +450,10 @@ void mwifiex_process_multi_chan_event(struct mwifiex_private *priv,
 
 		grp_info = (struct mwifiex_ie_types_mc_group_info *)tlv;
 		intf_num = grp_info->intf_num;
+		if (tlv_len < sizeof(*grp_info) - sizeof(grp_info->header) ||
+		    intf_num > tlv_len - (sizeof(*grp_info) - sizeof(grp_info->header)))
+			break;
+
 		for (i = 0; i < intf_num; i++) {
 			bss_type = grp_info->bss_type_numlist[i] >> 4;
 			bss_num = grp_info->bss_type_numlist[i] & BSS_NUM_MASK;
-- 
2.47.3

[PATCH wireless 3/3] wifi: mwifiex: cap TLV length in IBSS connected event handler

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

In the IBSS connected event handler, the buffer-bounded evt_len is
replaced with the TLV header length from the firmware. An inflated
value drives the IE parsing loop past the event buffer.

Cap the TLV-derived length at the remaining event data size.

Fixes: 432da7d243da ("mwifiex: add HT aggregation support for adhoc mode")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/marvell/mwifiex/sta_event.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_event.c b/drivers/net/wireless/marvell/mwifiex/sta_event.c
index 1f746e8f6b3e18..3f683698e4a60d 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
@@ -45,6 +45,8 @@ static int mwifiex_check_ibss_peer_capabilities(struct mwifiex_private *priv,
 		 */
 		evt_len = le16_to_cpu(tlv_mgmt_frame->header.len);
 		curr += (sizeof(*tlv_mgmt_frame) + 12);
+		if (evt_len > event->len - (curr - event->data))
+			evt_len = event->len - (curr - event->data);
 	} else {
 		mwifiex_dbg(priv->adapter, MSG,
 			    "management frame tlv not found!\n");
-- 
2.47.3