[PATCH] brcmfmac: Perform bound checking on vendor command buffer

[PATCH] brcmfmac: Perform bound checking on vendor command buffer

[Arend van Spriel]

From: Pontus Fuchs <pontusf@broadcom.com>

A short or malformed vendor command buffer could cause reads outside
the command buffer.

Cc: stable@vger.kernel.org # v3.19
Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
[arend@broadcom.com: slightly modified debug trace output]
Signed-off-by: Arend van Spriel <arend@broadcom.com>
---
 drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 50cdf70..8eff275 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
 	void *dcmd_buf = NULL, *wr_pointer;
 	u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
 
-	brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
-		  cmdhdr->len);
+	if (len < sizeof(*cmdhdr)) {
+		brcmf_err("vendor command too short: %d\n", len);
+		return -EINVAL;
+	}
 
 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
 	ifp = vif->ifp;
 
-	len -= sizeof(struct brcmf_vndr_dcmd_hdr);
+	brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
+
+	if (cmdhdr->offset > len) {
+		brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
+		return -EINVAL;
+	}
+
+	len -= cmdhdr->offset;
 	ret_len = cmdhdr->len;
 	if (ret_len > 0 || len > 0) {
 		if (len > BRCMF_DCMD_MAXLEN) {
-- 
1.9.1

Re: [PATCH] brcmfmac: Perform bound checking on vendor command buffer

[Arend van Spriel]

On 03/06/15 16:18, Arend van Spriel wrote:
> From: Pontus Fuchs<pontusf@broadcom.com>
>
> A short or malformed vendor command buffer could cause reads outside
> the command buffer.
>
> Cc: stable@vger.kernel.org # v3.19
> Signed-off-by: Pontus Fuchs<pontusf@broadcom.com>
> [arend@broadcom.com: slightly modified debug trace output]
> Signed-off-by: Arend van Spriel<arend@broadcom.com>
> ---

Hi Kalle,

Forgot to mention this is for v4.0 kernel.

Regards,
Arend

>   drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 ++++++++++++---
>   1 file changed, 12 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
> index 50cdf70..8eff275 100644
> --- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
> +++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
> @@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
>   	void *dcmd_buf = NULL, *wr_pointer;
>   	u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
>
> -	brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
> -		  cmdhdr->len);
> +	if (len<  sizeof(*cmdhdr)) {
> +		brcmf_err("vendor command too short: %d\n", len);
> +		return -EINVAL;
> +	}
>
>   	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
>   	ifp = vif->ifp;
>
> -	len -= sizeof(struct brcmf_vndr_dcmd_hdr);
> +	brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
> +
> +	if (cmdhdr->offset>  len) {
> +		brcmf_err("bad buffer offset %d>  %d\n", cmdhdr->offset, len);
> +		return -EINVAL;
> +	}
> +
> +	len -= cmdhdr->offset;
>   	ret_len = cmdhdr->len;
>   	if (ret_len>  0 || len>  0) {
>   		if (len>  BRCMF_DCMD_MAXLEN) {

Re: brcmfmac: Perform bound checking on vendor command buffer

[Kalle Valo]

> From: Pontus Fuchs <pontusf@broadcom.com>
> 
> A short or malformed vendor command buffer could cause reads outside
> the command buffer.
> 
> Cc: stable@vger.kernel.org # v3.19
> Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
> [arend@broadcom.com: slightly modified debug trace output]
> Signed-off-by: Arend van Spriel <arend@broadcom.com>

Thanks, applied to wireless-drivers.git.

Kalle Valo