* [PATCH] brcmfmac: Perform bound checking on vendor command buffer
@ 2015-03-06 15:18 Arend van Spriel
2015-03-06 15:20 ` Arend van Spriel
2015-03-07 8:54 ` Kalle Valo
0 siblings, 2 replies; 3+ messages in thread
From: Arend van Spriel @ 2015-03-06 15:18 UTC (permalink / raw)
To: Kalle Valo; +Cc: linux-wireless, Pontus Fuchs, Arend van Spriel
From: Pontus Fuchs <pontusf@broadcom.com>
A short or malformed vendor command buffer could cause reads outside
the command buffer.
Cc: stable@vger.kernel.org # v3.19
Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
[arend@broadcom.com: slightly modified debug trace output]
Signed-off-by: Arend van Spriel <arend@broadcom.com>
---
drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 50cdf70..8eff275 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
void *dcmd_buf = NULL, *wr_pointer;
u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
- brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
- cmdhdr->len);
+ if (len < sizeof(*cmdhdr)) {
+ brcmf_err("vendor command too short: %d\n", len);
+ return -EINVAL;
+ }
vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
ifp = vif->ifp;
- len -= sizeof(struct brcmf_vndr_dcmd_hdr);
+ brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
+
+ if (cmdhdr->offset > len) {
+ brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
+ return -EINVAL;
+ }
+
+ len -= cmdhdr->offset;
ret_len = cmdhdr->len;
if (ret_len > 0 || len > 0) {
if (len > BRCMF_DCMD_MAXLEN) {
--
1.9.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] brcmfmac: Perform bound checking on vendor command buffer
2015-03-06 15:18 [PATCH] brcmfmac: Perform bound checking on vendor command buffer Arend van Spriel
@ 2015-03-06 15:20 ` Arend van Spriel
2015-03-07 8:54 ` Kalle Valo
1 sibling, 0 replies; 3+ messages in thread
From: Arend van Spriel @ 2015-03-06 15:20 UTC (permalink / raw)
To: Kalle Valo; +Cc: Arend van Spriel, linux-wireless, Pontus Fuchs
On 03/06/15 16:18, Arend van Spriel wrote:
> From: Pontus Fuchs<pontusf@broadcom.com>
>
> A short or malformed vendor command buffer could cause reads outside
> the command buffer.
>
> Cc: stable@vger.kernel.org # v3.19
> Signed-off-by: Pontus Fuchs<pontusf@broadcom.com>
> [arend@broadcom.com: slightly modified debug trace output]
> Signed-off-by: Arend van Spriel<arend@broadcom.com>
> ---
Hi Kalle,
Forgot to mention this is for v4.0 kernel.
Regards,
Arend
> drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 ++++++++++++---
> 1 file changed, 12 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
> index 50cdf70..8eff275 100644
> --- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
> +++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
> @@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
> void *dcmd_buf = NULL, *wr_pointer;
> u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
>
> - brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
> - cmdhdr->len);
> + if (len< sizeof(*cmdhdr)) {
> + brcmf_err("vendor command too short: %d\n", len);
> + return -EINVAL;
> + }
>
> vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
> ifp = vif->ifp;
>
> - len -= sizeof(struct brcmf_vndr_dcmd_hdr);
> + brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
> +
> + if (cmdhdr->offset> len) {
> + brcmf_err("bad buffer offset %d> %d\n", cmdhdr->offset, len);
> + return -EINVAL;
> + }
> +
> + len -= cmdhdr->offset;
> ret_len = cmdhdr->len;
> if (ret_len> 0 || len> 0) {
> if (len> BRCMF_DCMD_MAXLEN) {
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: brcmfmac: Perform bound checking on vendor command buffer
2015-03-06 15:18 [PATCH] brcmfmac: Perform bound checking on vendor command buffer Arend van Spriel
2015-03-06 15:20 ` Arend van Spriel
@ 2015-03-07 8:54 ` Kalle Valo
1 sibling, 0 replies; 3+ messages in thread
From: Kalle Valo @ 2015-03-07 8:54 UTC (permalink / raw)
To: Arend van Spriel; +Cc: linux-wireless, Pontus Fuchs, Arend van Spriel
> From: Pontus Fuchs <pontusf@broadcom.com>
>
> A short or malformed vendor command buffer could cause reads outside
> the command buffer.
>
> Cc: stable@vger.kernel.org # v3.19
> Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
> [arend@broadcom.com: slightly modified debug trace output]
> Signed-off-by: Arend van Spriel <arend@broadcom.com>
Thanks, applied to wireless-drivers.git.
Kalle Valo
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-03-07 8:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-03-06 15:18 [PATCH] brcmfmac: Perform bound checking on vendor command buffer Arend van Spriel
2015-03-06 15:20 ` Arend van Spriel
2015-03-07 8:54 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).