[PATCH wireless 0/2] wifi: mwifiex: firmware response validation fixes (WMM + sta_list)

[PATCH wireless 0/2] wifi: mwifiex: firmware response validation fixes (WMM + sta_list)

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

Two input validation fixes for the mwifiex driver:

  1/2: The WMM status response handler uses the firmware-provided
       queue_index to index a 4-entry array without bounds checking.
       Values >= IEEE80211_NUM_ACS cause an out-of-bounds access.

  2/2: The AP station list response handler iterates over sta_info
       entries using firmware-provided sta_count without verifying
       the response buffer is large enough.

Tristan Madani (2):
  wifi: mwifiex: validate WMM queue_index in firmware response
  wifi: mwifiex: validate sta_count in AP sta_list response

 drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 14 +++++++++++---
 drivers/net/wireless/marvell/mwifiex/wmm.c         |  3 +++
 2 files changed, 14 insertions(+), 3 deletions(-)

-- 
2.47.3

[PATCH wireless 1/2] wifi: mwifiex: validate WMM queue_index in firmware response

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

mwifiex_ret_wmm_get_status() uses the firmware-provided queue_index to
index into priv->wmm.ac_status[] without checking it is within bounds.
A firmware response with queue_index >= IEEE80211_NUM_ACS causes an
access past the end of the array.

Add a bounds check before using queue_index as an array index.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/marvell/mwifiex/wmm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/wmm.c b/drivers/net/wireless/marvell/mwifiex/wmm.c
index 841505e83c7fd8..158e4a2ec0dd69 100644
--- a/drivers/net/wireless/marvell/mwifiex/wmm.c
+++ b/drivers/net/wireless/marvell/mwifiex/wmm.c
@@ -943,6 +943,9 @@ int mwifiex_ret_wmm_get_status(struct mwifiex_private *priv,
 				    tlv_wmm_qstatus->flow_required,
 				    tlv_wmm_qstatus->disabled);
 
+			if (tlv_wmm_qstatus->queue_index >= IEEE80211_NUM_ACS)
+				break;
+
 			ac_status = &priv->wmm.ac_status[tlv_wmm_qstatus->
 							 queue_index];
 			ac_status->disabled = tlv_wmm_qstatus->disabled;
-- 
2.47.3

[PATCH wireless 2/2] wifi: mwifiex: validate sta_count in AP sta_list response

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

mwifiex_ret_uap_sta_list() iterates over sta_info entries using the
firmware-provided sta_count without verifying the response buffer is
large enough to hold that many entries.

Add a size check that validates the response contains enough data for
the declared number of station entries before iterating.

Fixes: 8baca1a34d4c ("mwifiex: dump station support in uap mode")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
index 85512f526c5f2a..4d8493f9a6697e 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
@@ -973,11 +973,19 @@ static int mwifiex_ret_uap_sta_list(struct mwifiex_private *priv,
 {
 	struct host_cmd_ds_sta_list *sta_list =
 		&resp->params.sta_list;
-	struct mwifiex_ie_types_sta_info *sta_info = (void *)&sta_list->tlv;
-	int i;
+	struct mwifiex_ie_types_sta_info *sta_info;
+	u16 sta_count = le16_to_cpu(sta_list->sta_count);
+	u16 resp_size = le16_to_cpu(resp->size);
 	struct mwifiex_sta_node *sta_node;
+	int i;
+
+	if (resp_size < sizeof(*resp) - sizeof(resp->params) +
+	    sizeof(*sta_list) + sta_count * sizeof(*sta_info))
+		return -EINVAL;
+
+	sta_info = (void *)&sta_list->tlv;
 
-	for (i = 0; i < (le16_to_cpu(sta_list->sta_count)); i++) {
+	for (i = 0; i < sta_count; i++) {
 		sta_node = mwifiex_get_sta_entry(priv, sta_info->mac);
 		if (unlikely(!sta_node))
 			continue;
-- 
2.47.3