[PATCH wireless 2/2] wifi: mwifiex: validate sta_count in AP sta_list response

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

mwifiex_ret_uap_sta_list() iterates over sta_info entries using the
firmware-provided sta_count without verifying the response buffer is
large enough to hold that many entries.

Add a size check that validates the response contains enough data for
the declared number of station entries before iterating.

Fixes: 8baca1a34d4c ("mwifiex: dump station support in uap mode")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
index 85512f526c5f2a..4d8493f9a6697e 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
@@ -973,11 +973,19 @@ static int mwifiex_ret_uap_sta_list(struct mwifiex_private *priv,
 {
 	struct host_cmd_ds_sta_list *sta_list =
 		&resp->params.sta_list;
-	struct mwifiex_ie_types_sta_info *sta_info = (void *)&sta_list->tlv;
-	int i;
+	struct mwifiex_ie_types_sta_info *sta_info;
+	u16 sta_count = le16_to_cpu(sta_list->sta_count);
+	u16 resp_size = le16_to_cpu(resp->size);
 	struct mwifiex_sta_node *sta_node;
+	int i;
+
+	if (resp_size < sizeof(*resp) - sizeof(resp->params) +
+	    sizeof(*sta_list) + sta_count * sizeof(*sta_info))
+		return -EINVAL;
+
+	sta_info = (void *)&sta_list->tlv;
 
-	for (i = 0; i < (le16_to_cpu(sta_list->sta_count)); i++) {
+	for (i = 0; i < sta_count; i++) {
 		sta_node = mwifiex_get_sta_entry(priv, sta_info->mac);
 		if (unlikely(!sta_node))
 			continue;
-- 
2.47.3