* [PATCH 1/3] wifi: mwifiex: Fix tlv_buf_left calculation
2023-08-23 22:29 [PATCH 0/3] wifi: mwifiex: Fix tlv_buf_left calculation and replace one-element array Gustavo A. R. Silva
@ 2023-08-23 22:30 ` Gustavo A. R. Silva
2023-08-23 22:37 ` Justin Stitt
2023-08-23 22:32 ` [PATCH 2/3] wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync Gustavo A. R. Silva
2023-08-23 22:33 ` [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len Gustavo A. R. Silva
2 siblings, 1 reply; 8+ messages in thread
From: Gustavo A. R. Silva @ 2023-08-23 22:30 UTC (permalink / raw)
To: Brian Norris, Kalle Valo, Amitkumar Karwar, Xinming Hu,
Dan Williams
Cc: linux-wireless, linux-kernel, Gustavo A. R. Silva,
linux-hardening
In a TLV encoding scheme, the Length part represents the length after
the header containing the values for type and length. In this case,
`tlv_len` should be:
tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len
Notice that the `- 1` accounts for the one-element array `bitmap`, which
1-byte size is already included in `sizeof(*tlv_rxba)`.
So, if the above is correct, there is a double-counting of some members
in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp`
are calculated:
968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
in specific, members:
drivers/net/wireless/marvell/mwifiex/fw.h:777
777 u8 mac[ETH_ALEN];
778 u8 tid;
779 u8 reserved;
780 __le16 seq_num;
781 __le16 bitmap_len;
This is clearly wrong, and affects the subsequent decoding of data from
`event_buf` through `tlv_rxba`:
970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)`
in the calculation of `tlv_buf_left` and `tmp`.
This results in the following binary differences before/after changes:
| drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
| @@ -4698,11 +4698,11 @@
| tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
| - 1da7: lea -0x11(%rbx),%edx
| + 1da7: lea -0x4(%rbx),%edx
| 1daa: movzwl %bp,%eax
| drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
| tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len;
| - 1dad: lea 0x11(%r15,%rbp,1),%r15
| + 1dad: lea 0x4(%r15,%rbp,1),%r15
| drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
| tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
| 1db2: mov %edx,%ebx
The above reflects the desired change: avoid counting 13 too bytes;
which is the total size of the double-counted members in
`struct mwifiex_ie_types_rxba_sync`:
$ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
struct mwifiex_ie_types_rxba_sync {
struct mwifiex_ie_types_header header; /* 0 4 */
|-----------------------------------------------------------------------
| u8 mac[6]; /* 4 6 */ |
| u8 tid; /* 10 1 */ |
| u8 reserved; /* 11 1 */ |
| __le16 seq_num; /* 12 2 */ |
| __le16 bitmap_len; /* 14 2 */ |
| u8 bitmap[1]; /* 16 1 */ |
|----------------------------------------------------------------------|
| 13 bytes|
-----------
/* size: 17, cachelines: 1, members: 7 */
/* last cacheline: 17 bytes */
} __attribute__((__packed__));
Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 391793a16adc..d1d3632a3ed7 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -965,8 +965,8 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
}
}
- tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
- tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
+ tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
+ tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len;
tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
}
}
--
2.34.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH 1/3] wifi: mwifiex: Fix tlv_buf_left calculation
2023-08-23 22:30 ` [PATCH 1/3] wifi: mwifiex: Fix tlv_buf_left calculation Gustavo A. R. Silva
@ 2023-08-23 22:37 ` Justin Stitt
0 siblings, 0 replies; 8+ messages in thread
From: Justin Stitt @ 2023-08-23 22:37 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Brian Norris, Kalle Valo, Amitkumar Karwar, Xinming Hu,
Dan Williams, linux-wireless, linux-kernel, linux-hardening
On Wed, Aug 23, 2023 at 3:30 PM Gustavo A. R. Silva
<gustavoars@kernel.org> wrote:
>
> In a TLV encoding scheme, the Length part represents the length after
> the header containing the values for type and length. In this case,
> `tlv_len` should be:
>
> tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len
>
> Notice that the `- 1` accounts for the one-element array `bitmap`, which
> 1-byte size is already included in `sizeof(*tlv_rxba)`.
>
> So, if the above is correct, there is a double-counting of some members
> in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp`
> are calculated:
>
> 968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
> 969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
>
> in specific, members:
>
> drivers/net/wireless/marvell/mwifiex/fw.h:777
> 777 u8 mac[ETH_ALEN];
> 778 u8 tid;
> 779 u8 reserved;
> 780 __le16 seq_num;
> 781 __le16 bitmap_len;
>
> This is clearly wrong, and affects the subsequent decoding of data from
> `event_buf` through `tlv_rxba`:
>
> 970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
>
> Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)`
> in the calculation of `tlv_buf_left` and `tmp`.
>
> This results in the following binary differences before/after changes:
>
> | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> | @@ -4698,11 +4698,11 @@
> | tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
> | - 1da7: lea -0x11(%rbx),%edx
> | + 1da7: lea -0x4(%rbx),%edx
> | 1daa: movzwl %bp,%eax
> | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
> | tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len;
> | - 1dad: lea 0x11(%r15,%rbp,1),%r15
> | + 1dad: lea 0x4(%r15,%rbp,1),%r15
> | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
> | tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
> | 1db2: mov %edx,%ebx
>
> The above reflects the desired change: avoid counting 13 too bytes;
> which is the total size of the double-counted members in
> `struct mwifiex_ie_types_rxba_sync`:
>
> $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> struct mwifiex_ie_types_rxba_sync {
> struct mwifiex_ie_types_header header; /* 0 4 */
>
> |-----------------------------------------------------------------------
> | u8 mac[6]; /* 4 6 */ |
> | u8 tid; /* 10 1 */ |
> | u8 reserved; /* 11 1 */ |
> | __le16 seq_num; /* 12 2 */ |
> | __le16 bitmap_len; /* 14 2 */ |
> | u8 bitmap[1]; /* 16 1 */ |
> |----------------------------------------------------------------------|
> | 13 bytes|
> -----------
>
> /* size: 17, cachelines: 1, members: 7 */
> /* last cacheline: 17 bytes */
> } __attribute__((__packed__));
>
> Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Justin Stitt <justinstitt@google.com>
> ---
> drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> index 391793a16adc..d1d3632a3ed7 100644
> --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> @@ -965,8 +965,8 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
> }
> }
>
> - tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
> - tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
> + tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
> + tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len;
> tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
> }
> }
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH 2/3] wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync
2023-08-23 22:29 [PATCH 0/3] wifi: mwifiex: Fix tlv_buf_left calculation and replace one-element array Gustavo A. R. Silva
2023-08-23 22:30 ` [PATCH 1/3] wifi: mwifiex: Fix tlv_buf_left calculation Gustavo A. R. Silva
@ 2023-08-23 22:32 ` Gustavo A. R. Silva
2023-08-23 22:38 ` Justin Stitt
2023-08-23 22:33 ` [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len Gustavo A. R. Silva
2 siblings, 1 reply; 8+ messages in thread
From: Gustavo A. R. Silva @ 2023-08-23 22:32 UTC (permalink / raw)
To: Brian Norris, Kalle Valo, Amitkumar Karwar, Xinming Hu,
Dan Williams
Cc: linux-wireless, linux-kernel, Gustavo A. R. Silva,
linux-hardening
One-element and zero-length arrays are deprecated. So, replace
one-element array in struct mwifiex_ie_types_rxba_sync with
flexible-array member, and refactor the rest of the code, accordingly.
This results in no differences in binary output.
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +-
drivers/net/wireless/marvell/mwifiex/fw.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index d1d3632a3ed7..735aac52bdc4 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -918,7 +918,7 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
mwifiex_dbg_dump(priv->adapter, EVT_D, "RXBA_SYNC event:",
event_buf, len);
- while (tlv_buf_left >= sizeof(*tlv_rxba)) {
+ while (tlv_buf_left > sizeof(*tlv_rxba)) {
tlv_type = le16_to_cpu(tlv_rxba->header.type);
tlv_len = le16_to_cpu(tlv_rxba->header.len);
if (tlv_type != TLV_TYPE_RXBA_SYNC) {
diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
index f2168fac95ed..8e6db904e5b2 100644
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -779,7 +779,7 @@ struct mwifiex_ie_types_rxba_sync {
u8 reserved;
__le16 seq_num;
__le16 bitmap_len;
- u8 bitmap[1];
+ u8 bitmap[];
} __packed;
struct chan_band_param_set {
--
2.34.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH 2/3] wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync
2023-08-23 22:32 ` [PATCH 2/3] wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync Gustavo A. R. Silva
@ 2023-08-23 22:38 ` Justin Stitt
0 siblings, 0 replies; 8+ messages in thread
From: Justin Stitt @ 2023-08-23 22:38 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Brian Norris, Kalle Valo, Amitkumar Karwar, Xinming Hu,
Dan Williams, linux-wireless, linux-kernel, linux-hardening
On Wed, Aug 23, 2023 at 3:32 PM Gustavo A. R. Silva
<gustavoars@kernel.org> wrote:
>
> One-element and zero-length arrays are deprecated. So, replace
> one-element array in struct mwifiex_ie_types_rxba_sync with
> flexible-array member, and refactor the rest of the code, accordingly.
>
> This results in no differences in binary output.
>
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Justin Stitt <justinstitt@google.com>
> ---
> drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +-
> drivers/net/wireless/marvell/mwifiex/fw.h | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> index d1d3632a3ed7..735aac52bdc4 100644
> --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> @@ -918,7 +918,7 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
>
> mwifiex_dbg_dump(priv->adapter, EVT_D, "RXBA_SYNC event:",
> event_buf, len);
> - while (tlv_buf_left >= sizeof(*tlv_rxba)) {
> + while (tlv_buf_left > sizeof(*tlv_rxba)) {
> tlv_type = le16_to_cpu(tlv_rxba->header.type);
> tlv_len = le16_to_cpu(tlv_rxba->header.len);
> if (tlv_type != TLV_TYPE_RXBA_SYNC) {
> diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
> index f2168fac95ed..8e6db904e5b2 100644
> --- a/drivers/net/wireless/marvell/mwifiex/fw.h
> +++ b/drivers/net/wireless/marvell/mwifiex/fw.h
> @@ -779,7 +779,7 @@ struct mwifiex_ie_types_rxba_sync {
> u8 reserved;
> __le16 seq_num;
> __le16 bitmap_len;
> - u8 bitmap[1];
> + u8 bitmap[];
> } __packed;
>
> struct chan_band_param_set {
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
2023-08-23 22:29 [PATCH 0/3] wifi: mwifiex: Fix tlv_buf_left calculation and replace one-element array Gustavo A. R. Silva
2023-08-23 22:30 ` [PATCH 1/3] wifi: mwifiex: Fix tlv_buf_left calculation Gustavo A. R. Silva
2023-08-23 22:32 ` [PATCH 2/3] wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync Gustavo A. R. Silva
@ 2023-08-23 22:33 ` Gustavo A. R. Silva
2023-08-23 22:38 ` Justin Stitt
2023-08-24 1:07 ` kernel test robot
2 siblings, 2 replies; 8+ messages in thread
From: Gustavo A. R. Silva @ 2023-08-23 22:33 UTC (permalink / raw)
To: Brian Norris, Kalle Valo, Amitkumar Karwar, Xinming Hu,
Dan Williams
Cc: linux-wireless, linux-kernel, Gustavo A. R. Silva,
linux-hardening
Add sanity checks for both `tlv_len` and `tlv_bitmap_len` before
decoding data from `event_buf`.
This prevents any malicious or buggy firmware from overflowing
`event_buf` through large values for `tlv_len` or `tlv_bitmap_len`.
Suggested-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
.../net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 735aac52bdc4..9ee3b9f1e9ce 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -921,6 +921,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
while (tlv_buf_left > sizeof(*tlv_rxba)) {
tlv_type = le16_to_cpu(tlv_rxba->header.type);
tlv_len = le16_to_cpu(tlv_rxba->header.len);
+ if (size_add(sizeof(tlv_rxba->header), tlv_len) > tlv_buf_left) {
+ mwifiex_dbg(priv->adapter, WARN,
+ "TLV size (%ld) overflows event_buf (%d)\n",
+ size_add(sizeof(tlv_rxba->header), tlv_len),
+ tlv_buf_left);
+ return;
+ }
+
if (tlv_type != TLV_TYPE_RXBA_SYNC) {
mwifiex_dbg(priv->adapter, ERROR,
"Wrong TLV id=0x%x\n", tlv_type);
@@ -929,6 +937,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
tlv_seq_num = le16_to_cpu(tlv_rxba->seq_num);
tlv_bitmap_len = le16_to_cpu(tlv_rxba->bitmap_len);
+ if (size_add(sizeof(*tlv_rxba), tlv_bitmap_len) > tlv_buf_left) {
+ mwifiex_dbg(priv->adapter, WARN,
+ "TLV size (%ld) overflows event_buf (%d)\n",
+ size_add(sizeof(*tlv_rxba), tlv_bitmap_len),
+ tlv_buf_left);
+ return;
+ }
+
mwifiex_dbg(priv->adapter, INFO,
"%pM tid=%d seq_num=%d bitmap_len=%d\n",
tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,
--
2.34.1
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
2023-08-23 22:33 ` [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len Gustavo A. R. Silva
@ 2023-08-23 22:38 ` Justin Stitt
2023-08-24 1:07 ` kernel test robot
1 sibling, 0 replies; 8+ messages in thread
From: Justin Stitt @ 2023-08-23 22:38 UTC (permalink / raw)
To: Gustavo A. R. Silva
Cc: Brian Norris, Kalle Valo, Amitkumar Karwar, Xinming Hu,
Dan Williams, linux-wireless, linux-kernel, linux-hardening
On Wed, Aug 23, 2023 at 3:33 PM Gustavo A. R. Silva
<gustavoars@kernel.org> wrote:
>
> Add sanity checks for both `tlv_len` and `tlv_bitmap_len` before
> decoding data from `event_buf`.
>
> This prevents any malicious or buggy firmware from overflowing
> `event_buf` through large values for `tlv_len` or `tlv_bitmap_len`.
>
> Suggested-by: Dan Williams <dcbw@redhat.com>
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Justin Stitt <justinstitt@google.com>
> ---
> .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 ++++++++++++++++
> 1 file changed, 16 insertions(+)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> index 735aac52bdc4..9ee3b9f1e9ce 100644
> --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> @@ -921,6 +921,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
> while (tlv_buf_left > sizeof(*tlv_rxba)) {
> tlv_type = le16_to_cpu(tlv_rxba->header.type);
> tlv_len = le16_to_cpu(tlv_rxba->header.len);
> + if (size_add(sizeof(tlv_rxba->header), tlv_len) > tlv_buf_left) {
> + mwifiex_dbg(priv->adapter, WARN,
> + "TLV size (%ld) overflows event_buf (%d)\n",
> + size_add(sizeof(tlv_rxba->header), tlv_len),
> + tlv_buf_left);
> + return;
> + }
> +
> if (tlv_type != TLV_TYPE_RXBA_SYNC) {
> mwifiex_dbg(priv->adapter, ERROR,
> "Wrong TLV id=0x%x\n", tlv_type);
> @@ -929,6 +937,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
>
> tlv_seq_num = le16_to_cpu(tlv_rxba->seq_num);
> tlv_bitmap_len = le16_to_cpu(tlv_rxba->bitmap_len);
> + if (size_add(sizeof(*tlv_rxba), tlv_bitmap_len) > tlv_buf_left) {
> + mwifiex_dbg(priv->adapter, WARN,
> + "TLV size (%ld) overflows event_buf (%d)\n",
> + size_add(sizeof(*tlv_rxba), tlv_bitmap_len),
> + tlv_buf_left);
> + return;
> + }
> +
> mwifiex_dbg(priv->adapter, INFO,
> "%pM tid=%d seq_num=%d bitmap_len=%d\n",
> tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
2023-08-23 22:33 ` [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len Gustavo A. R. Silva
2023-08-23 22:38 ` Justin Stitt
@ 2023-08-24 1:07 ` kernel test robot
1 sibling, 0 replies; 8+ messages in thread
From: kernel test robot @ 2023-08-24 1:07 UTC (permalink / raw)
To: Gustavo A. R. Silva, Brian Norris, Kalle Valo, Amitkumar Karwar,
Xinming Hu, Dan Williams
Cc: oe-kbuild-all, linux-wireless, linux-kernel, Gustavo A. R. Silva,
linux-hardening
Hi Gustavo,
kernel test robot noticed the following build warnings:
[auto build test WARNING on linus/master]
[also build test WARNING on v6.5-rc7 next-20230823]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Gustavo-A-R-Silva/wifi-mwifiex-Fix-tlv_buf_left-calculation/20230824-063517
base: linus/master
patch link: https://lore.kernel.org/r/587423b0737108effe82aefed4407daca39e9a51.1692829410.git.gustavoars%40kernel.org
patch subject: [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
config: m68k-allyesconfig (https://download.01.org/0day-ci/archive/20230824/202308240844.leyoOwdG-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 13.2.0
reproduce: (https://download.01.org/0day-ci/archive/20230824/202308240844.leyoOwdG-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202308240844.leyoOwdG-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:12:
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c: In function 'mwifiex_11n_rxba_sync_event':
>> drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:926:37: warning: format '%ld' expects argument of type 'long int', but argument 4 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
926 | "TLV size (%ld) overflows event_buf (%d)\n",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
927 | size_add(sizeof(tlv_rxba->header), tlv_len),
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| size_t {aka unsigned int}
drivers/net/wireless/marvell/mwifiex/main.h:199:51: note: in definition of macro 'mwifiex_dbg'
199 | _mwifiex_dbg(adapter, MWIFIEX_DBG_##mask, fmt, ##__VA_ARGS__)
| ^~~
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:926:50: note: format string is defined here
926 | "TLV size (%ld) overflows event_buf (%d)\n",
| ~~^
| |
| long int
| %d
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:942:37: warning: format '%ld' expects argument of type 'long int', but argument 4 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
942 | "TLV size (%ld) overflows event_buf (%d)\n",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
943 | size_add(sizeof(*tlv_rxba), tlv_bitmap_len),
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| size_t {aka unsigned int}
drivers/net/wireless/marvell/mwifiex/main.h:199:51: note: in definition of macro 'mwifiex_dbg'
199 | _mwifiex_dbg(adapter, MWIFIEX_DBG_##mask, fmt, ##__VA_ARGS__)
| ^~~
drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:942:50: note: format string is defined here
942 | "TLV size (%ld) overflows event_buf (%d)\n",
| ~~^
| |
| long int
| %d
vim +926 drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
904
905 /* This function handles rxba_sync event
906 */
907 void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
908 u8 *event_buf, u16 len)
909 {
910 struct mwifiex_ie_types_rxba_sync *tlv_rxba = (void *)event_buf;
911 u16 tlv_type, tlv_len;
912 struct mwifiex_rx_reorder_tbl *rx_reor_tbl_ptr;
913 u8 i, j;
914 u16 seq_num, tlv_seq_num, tlv_bitmap_len;
915 int tlv_buf_left = len;
916 int ret;
917 u8 *tmp;
918
919 mwifiex_dbg_dump(priv->adapter, EVT_D, "RXBA_SYNC event:",
920 event_buf, len);
921 while (tlv_buf_left > sizeof(*tlv_rxba)) {
922 tlv_type = le16_to_cpu(tlv_rxba->header.type);
923 tlv_len = le16_to_cpu(tlv_rxba->header.len);
924 if (size_add(sizeof(tlv_rxba->header), tlv_len) > tlv_buf_left) {
925 mwifiex_dbg(priv->adapter, WARN,
> 926 "TLV size (%ld) overflows event_buf (%d)\n",
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 8+ messages in thread