Re: [PATCH] brcmfmac: Perform bound checking on vendor command buffer

[Arend van Spriel <arend@broadcom.com>]

On 03/06/15 16:18, Arend van Spriel wrote:
> From: Pontus Fuchs<pontusf@broadcom.com>
>
> A short or malformed vendor command buffer could cause reads outside
> the command buffer.
>
> Cc: stable@vger.kernel.org # v3.19
> Signed-off-by: Pontus Fuchs<pontusf@broadcom.com>
> [arend@broadcom.com: slightly modified debug trace output]
> Signed-off-by: Arend van Spriel<arend@broadcom.com>
> ---

Hi Kalle,

Forgot to mention this is for v4.0 kernel.

Regards,
Arend

>   drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 ++++++++++++---
>   1 file changed, 12 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
> index 50cdf70..8eff275 100644
> --- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
> +++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
> @@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
>   	void *dcmd_buf = NULL, *wr_pointer;
>   	u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
>
> -	brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
> -		  cmdhdr->len);
> +	if (len<  sizeof(*cmdhdr)) {
> +		brcmf_err("vendor command too short: %d\n", len);
> +		return -EINVAL;
> +	}
>
>   	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
>   	ifp = vif->ifp;
>
> -	len -= sizeof(struct brcmf_vndr_dcmd_hdr);
> +	brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
> +
> +	if (cmdhdr->offset>  len) {
> +		brcmf_err("bad buffer offset %d>  %d\n", cmdhdr->offset, len);
> +		return -EINVAL;
> +	}
> +
> +	len -= cmdhdr->offset;
>   	ret_len = cmdhdr->len;
>   	if (ret_len>  0 || len>  0) {
>   		if (len>  BRCMF_DCMD_MAXLEN) {