[PATCH v2 0/3] wifi: mwifiex: Fix tlv_buf_left calculation and replace one-element array

[PATCH v2 0/3] wifi: mwifiex: Fix tlv_buf_left calculation and replace one-element array

[Gustavo A. R. Silva]

Hi all!

This small series is aimed at fixing a bug in the tlv_buf_left
calculation, doing a flexible-array transformation, and adding
a couple of sanity checks.

Thanks

Changes in v2:
 - Fix format specifier in patch 3/3: %ld -> %zu
 - Update warning messages to explicitly mention that TLV size is
   greater than tlv_buf_len in patch 3/3.

v1:
 - Link: https://lore.kernel.org/linux-hardening/cover.1692829410.git.gustavoars@kernel.org/

Gustavo A. R. Silva (3):
  wifi: mwifiex: Fix tlv_buf_left calculation
  wifi: mwifiex: Replace one-element array with flexible-array member in
    struct mwifiex_ie_types_rxba_sync
  wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len

 .../wireless/marvell/mwifiex/11n_rxreorder.c  | 22 ++++++++++++++++---
 drivers/net/wireless/marvell/mwifiex/fw.h     |  2 +-
 2 files changed, 20 insertions(+), 4 deletions(-)

-- 
2.34.1

[PATCH v2 1/3] wifi: mwifiex: Fix tlv_buf_left calculation

[Gustavo A. R. Silva]

In a TLV encoding scheme, the Length part represents the length after
the header containing the values for type and length. In this case,
`tlv_len` should be:

tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len

Notice that the `- 1` accounts for the one-element array `bitmap`, which
1-byte size is already included in `sizeof(*tlv_rxba)`.

So, if the above is correct, there is a double-counting of some members
in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp`
are calculated:

968                 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
969                 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);

in specific, members:

drivers/net/wireless/marvell/mwifiex/fw.h:777
 777         u8 mac[ETH_ALEN];
 778         u8 tid;
 779         u8 reserved;
 780         __le16 seq_num;
 781         __le16 bitmap_len;

This is clearly wrong, and affects the subsequent decoding of data in
`event_buf` through `tlv_rxba`:

970                 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;

Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)`
in the calculation of `tlv_buf_left` and `tmp`.

This results in the following binary differences before/after changes:

| drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
| @@ -4698,11 +4698,11 @@
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
|                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
| -    1da7:      lea    -0x11(%rbx),%edx
| +    1da7:      lea    -0x4(%rbx),%edx
|      1daa:      movzwl %bp,%eax
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
|                 tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
| -    1dad:      lea    0x11(%r15,%rbp,1),%r15
| +    1dad:      lea    0x4(%r15,%rbp,1),%r15

The above reflects the desired change: avoid counting 13 too many bytes;
which is the total size of the double-counted members in
`struct mwifiex_ie_types_rxba_sync`:

$ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
struct mwifiex_ie_types_rxba_sync {
	struct mwifiex_ie_types_header header;           /*     0     4 */

     |-----------------------------------------------------------------------
     |  u8                         mac[6];               /*     4     6 */  |
     |	u8                         tid;                  /*    10     1 */  |
     |  u8                         reserved;             /*    11     1 */  |
     | 	__le16                     seq_num;              /*    12     2 */  |
     | 	__le16                     bitmap_len;           /*    14     2 */  |
     |  u8                         bitmap[1];            /*    16     1 */  |
     |----------------------------------------------------------------------|
								  | 13 bytes|
								  -----------

	/* size: 17, cachelines: 1, members: 7 */
	/* last cacheline: 17 bytes */
} __attribute__((__packed__));

Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
Changes in v2:
 - Fix typo in changelog text: s/too bytes/too many bytes
 - Update binary diff snapshot in changelog text.

v1:
 - Link: https://lore.kernel.org/linux-hardening/698dc480d939e3ae490140db5c2f36eb84093594.1692829410.git.gustavoars@kernel.org/

 drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 391793a16adc..d1d3632a3ed7 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -965,8 +965,8 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
 			}
 		}
 
-		tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
-		tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
+		tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
+		tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
 		tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
 	}
 }
-- 
2.34.1

Re: [PATCH v2 1/3] wifi: mwifiex: Fix tlv_buf_left calculation

[Kees Cook]

On Thu, Aug 24, 2023 at 09:06:51PM -0600, Gustavo A. R. Silva wrote:
> In a TLV encoding scheme, the Length part represents the length after
> the header containing the values for type and length. In this case,
> `tlv_len` should be:
> 
> tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len
> 
> Notice that the `- 1` accounts for the one-element array `bitmap`, which
> 1-byte size is already included in `sizeof(*tlv_rxba)`.
> 
> So, if the above is correct, there is a double-counting of some members
> in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp`
> are calculated:
> 
> 968                 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
> 969                 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
> 
> in specific, members:
> 
> drivers/net/wireless/marvell/mwifiex/fw.h:777
>  777         u8 mac[ETH_ALEN];
>  778         u8 tid;
>  779         u8 reserved;
>  780         __le16 seq_num;
>  781         __le16 bitmap_len;
> 
> This is clearly wrong, and affects the subsequent decoding of data in
> `event_buf` through `tlv_rxba`:
> 
> 970                 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
> 
> Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)`
> in the calculation of `tlv_buf_left` and `tmp`.
> 
> This results in the following binary differences before/after changes:
> 
> | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> | @@ -4698,11 +4698,11 @@
> |  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
> |                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
> | -    1da7:      lea    -0x11(%rbx),%edx
> | +    1da7:      lea    -0x4(%rbx),%edx
> |      1daa:      movzwl %bp,%eax
> |  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
> |                 tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
> | -    1dad:      lea    0x11(%r15,%rbp,1),%r15
> | +    1dad:      lea    0x4(%r15,%rbp,1),%r15
> 
> The above reflects the desired change: avoid counting 13 too many bytes;
> which is the total size of the double-counted members in
> `struct mwifiex_ie_types_rxba_sync`:
> 
> $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> struct mwifiex_ie_types_rxba_sync {
> 	struct mwifiex_ie_types_header header;           /*     0     4 */
> 
>      |-----------------------------------------------------------------------
>      |  u8                         mac[6];               /*     4     6 */  |
>      |	u8                         tid;                  /*    10     1 */  |
>      |  u8                         reserved;             /*    11     1 */  |
>      | 	__le16                     seq_num;              /*    12     2 */  |
>      | 	__le16                     bitmap_len;           /*    14     2 */  |
>      |  u8                         bitmap[1];            /*    16     1 */  |
>      |----------------------------------------------------------------------|
> 								  | 13 bytes|
> 								  -----------
> 
> 	/* size: 17, cachelines: 1, members: 7 */
> 	/* last cacheline: 17 bytes */
> } __attribute__((__packed__));
> 
> Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Excellent commit log!

Reviewed-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook

Re: [PATCH v2 1/3] wifi: mwifiex: Fix tlv_buf_left calculation

[Kalle Valo]

"Gustavo A. R. Silva" <gustavoars@kernel.org> wrote:

> In a TLV encoding scheme, the Length part represents the length after
> the header containing the values for type and length. In this case,
> `tlv_len` should be:
> 
> tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len
> 
> Notice that the `- 1` accounts for the one-element array `bitmap`, which
> 1-byte size is already included in `sizeof(*tlv_rxba)`.
> 
> So, if the above is correct, there is a double-counting of some members
> in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp`
> are calculated:
> 
> 968                 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
> 969                 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
> 
> in specific, members:
> 
> drivers/net/wireless/marvell/mwifiex/fw.h:777
>  777         u8 mac[ETH_ALEN];
>  778         u8 tid;
>  779         u8 reserved;
>  780         __le16 seq_num;
>  781         __le16 bitmap_len;
> 
> This is clearly wrong, and affects the subsequent decoding of data in
> `event_buf` through `tlv_rxba`:
> 
> 970                 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
> 
> Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)`
> in the calculation of `tlv_buf_left` and `tmp`.
> 
> This results in the following binary differences before/after changes:
> 
> | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> | @@ -4698,11 +4698,11 @@
> |  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
> |                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
> | -    1da7:      lea    -0x11(%rbx),%edx
> | +    1da7:      lea    -0x4(%rbx),%edx
> |      1daa:      movzwl %bp,%eax
> |  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
> |                 tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
> | -    1dad:      lea    0x11(%r15,%rbp,1),%r15
> | +    1dad:      lea    0x4(%r15,%rbp,1),%r15
> 
> The above reflects the desired change: avoid counting 13 too many bytes;
> which is the total size of the double-counted members in
> `struct mwifiex_ie_types_rxba_sync`:
> 
> $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> struct mwifiex_ie_types_rxba_sync {
> 	struct mwifiex_ie_types_header header;           /*     0     4 */
> 
>      |-----------------------------------------------------------------------
>      |  u8                         mac[6];               /*     4     6 */  |
>      |	u8                         tid;                  /*    10     1 */  |
>      |  u8                         reserved;             /*    11     1 */  |
>      | 	__le16                     seq_num;              /*    12     2 */  |
>      | 	__le16                     bitmap_len;           /*    14     2 */  |
>      |  u8                         bitmap[1];            /*    16     1 */  |
>      |----------------------------------------------------------------------|
> 								  | 13 bytes|
> 								  -----------
> 
> 	/* size: 17, cachelines: 1, members: 7 */
> 	/* last cacheline: 17 bytes */
> } __attribute__((__packed__));
> 
> Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> Reviewed-by: Kees Cook <keescook@chromium.org>

3 patches applied to wireless.git, thanks.

eec679e4ac5f wifi: mwifiex: Fix tlv_buf_left calculation
c7847241de28 wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync
d5a93b7d2877 wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/06668edd68e7a26bbfeebd1201ae077a2a7a8bce.1692931954.git.gustavoars@kernel.org/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH v2 1/3] wifi: mwifiex: Fix tlv_buf_left calculation

[Gustavo A. R. Silva]

> 3 patches applied to wireless.git, thanks.

Awesome. :)

> 
> eec679e4ac5f wifi: mwifiex: Fix tlv_buf_left calculation
> c7847241de28 wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync
> d5a93b7d2877 wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
> 

Thanks!
--
Gustavo

[PATCH v2 2/3] wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync

[Gustavo A. R. Silva]

One-element and zero-length arrays are deprecated. So, replace
one-element array in struct mwifiex_ie_types_rxba_sync with
flexible-array member, and refactor the rest of the code, accordingly.

This results in no differences in binary output.

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
Changes in v2:
 - None.

v1:
 - Link: https://lore.kernel.org/linux-hardening/774ab3c21e1f2ee9c95909e5779216d83d05fd9f.1692829410.git.gustavoars@kernel.org/

 drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 2 +-
 drivers/net/wireless/marvell/mwifiex/fw.h            | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index d1d3632a3ed7..735aac52bdc4 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -918,7 +918,7 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
 
 	mwifiex_dbg_dump(priv->adapter, EVT_D, "RXBA_SYNC event:",
 			 event_buf, len);
-	while (tlv_buf_left >= sizeof(*tlv_rxba)) {
+	while (tlv_buf_left > sizeof(*tlv_rxba)) {
 		tlv_type = le16_to_cpu(tlv_rxba->header.type);
 		tlv_len  = le16_to_cpu(tlv_rxba->header.len);
 		if (tlv_type != TLV_TYPE_RXBA_SYNC) {
diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
index f2168fac95ed..8e6db904e5b2 100644
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -779,7 +779,7 @@ struct mwifiex_ie_types_rxba_sync {
 	u8 reserved;
 	__le16 seq_num;
 	__le16 bitmap_len;
-	u8 bitmap[1];
+	u8 bitmap[];
 } __packed;
 
 struct chan_band_param_set {
-- 
2.34.1

Re: [PATCH v2 2/3] wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync

[Kees Cook]

On Thu, Aug 24, 2023 at 09:07:43PM -0600, Gustavo A. R. Silva wrote:
> One-element and zero-length arrays are deprecated. So, replace
> one-element array in struct mwifiex_ie_types_rxba_sync with
> flexible-array member, and refactor the rest of the code, accordingly.
> 
> This results in no differences in binary output.
> 
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Reviewed-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook

[PATCH v2 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len

[Gustavo A. R. Silva]

Add sanity checks for both `tlv_len` and `tlv_bitmap_len` before
decoding data from `event_buf`.

This prevents any malicious or buggy firmware from overflowing
`event_buf` through large values for `tlv_len` and `tlv_bitmap_len`.

Suggested-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
Changes in v2:
 - Fix format specifier: %ld -> %zu
   | Reported-by: kernel test robot <lkp@intel.com>
   | Closes: https://lore.kernel.org/oe-kbuild-all/202308240844.leyoOwdG-lkp@intel.com/

 - Update warning messages to explicitly mention that TLV size is
   greater than tlv_buf_len.

v1:
 - Link: https://lore.kernel.org/linux-hardening/587423b0737108effe82aefed4407daca39e9a51.1692829410.git.gustavoars@kernel.org/

 .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 735aac52bdc4..10690e82358b 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -921,6 +921,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
 	while (tlv_buf_left > sizeof(*tlv_rxba)) {
 		tlv_type = le16_to_cpu(tlv_rxba->header.type);
 		tlv_len  = le16_to_cpu(tlv_rxba->header.len);
+		if (size_add(sizeof(tlv_rxba->header), tlv_len) > tlv_buf_left) {
+			mwifiex_dbg(priv->adapter, WARN,
+				    "TLV size (%zu) overflows event_buf buf_left=%d\n",
+				    size_add(sizeof(tlv_rxba->header), tlv_len),
+				    tlv_buf_left);
+			return;
+		}
+
 		if (tlv_type != TLV_TYPE_RXBA_SYNC) {
 			mwifiex_dbg(priv->adapter, ERROR,
 				    "Wrong TLV id=0x%x\n", tlv_type);
@@ -929,6 +937,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
 
 		tlv_seq_num = le16_to_cpu(tlv_rxba->seq_num);
 		tlv_bitmap_len = le16_to_cpu(tlv_rxba->bitmap_len);
+		if (size_add(sizeof(*tlv_rxba), tlv_bitmap_len) > tlv_buf_left) {
+			mwifiex_dbg(priv->adapter, WARN,
+				    "TLV size (%zu) overflows event_buf buf_left=%d\n",
+				    size_add(sizeof(*tlv_rxba), tlv_bitmap_len),
+				    tlv_buf_left);
+			return;
+		}
+
 		mwifiex_dbg(priv->adapter, INFO,
 			    "%pM tid=%d seq_num=%d bitmap_len=%d\n",
 			    tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,
-- 
2.34.1

Re: [PATCH v2 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len

[Kees Cook]

On Thu, Aug 24, 2023 at 09:10:45PM -0600, Gustavo A. R. Silva wrote:
> Add sanity checks for both `tlv_len` and `tlv_bitmap_len` before
> decoding data from `event_buf`.
> 
> This prevents any malicious or buggy firmware from overflowing
> `event_buf` through large values for `tlv_len` and `tlv_bitmap_len`.
> 
> Suggested-by: Dan Williams <dcbw@redhat.com>
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
> Changes in v2:
>  - Fix format specifier: %ld -> %zu
>    | Reported-by: kernel test robot <lkp@intel.com>
>    | Closes: https://lore.kernel.org/oe-kbuild-all/202308240844.leyoOwdG-lkp@intel.com/
> 
>  - Update warning messages to explicitly mention that TLV size is
>    greater than tlv_buf_len.
> 
> v1:
>  - Link: https://lore.kernel.org/linux-hardening/587423b0737108effe82aefed4407daca39e9a51.1692829410.git.gustavoars@kernel.org/
> 
>  .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 ++++++++++++++++
>  1 file changed, 16 insertions(+)
> 
> diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> index 735aac52bdc4..10690e82358b 100644
> --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> @@ -921,6 +921,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
>  	while (tlv_buf_left > sizeof(*tlv_rxba)) {
>  		tlv_type = le16_to_cpu(tlv_rxba->header.type);
>  		tlv_len  = le16_to_cpu(tlv_rxba->header.len);
> +		if (size_add(sizeof(tlv_rxba->header), tlv_len) > tlv_buf_left) {
> +			mwifiex_dbg(priv->adapter, WARN,
> +				    "TLV size (%zu) overflows event_buf buf_left=%d\n",
> +				    size_add(sizeof(tlv_rxba->header), tlv_len),
> +				    tlv_buf_left);

With the suggested change to make this a warning and not dbg:

Reviewed-by: Kees Cook <keescook@chromium.org>

Thanks!

-Kees

> +			return;
> +		}
> +
>  		if (tlv_type != TLV_TYPE_RXBA_SYNC) {
>  			mwifiex_dbg(priv->adapter, ERROR,
>  				    "Wrong TLV id=0x%x\n", tlv_type);
> @@ -929,6 +937,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
>  
>  		tlv_seq_num = le16_to_cpu(tlv_rxba->seq_num);
>  		tlv_bitmap_len = le16_to_cpu(tlv_rxba->bitmap_len);
> +		if (size_add(sizeof(*tlv_rxba), tlv_bitmap_len) > tlv_buf_left) {
> +			mwifiex_dbg(priv->adapter, WARN,
> +				    "TLV size (%zu) overflows event_buf buf_left=%d\n",
> +				    size_add(sizeof(*tlv_rxba), tlv_bitmap_len),
> +				    tlv_buf_left);
> +			return;
> +		}
> +
>  		mwifiex_dbg(priv->adapter, INFO,
>  			    "%pM tid=%d seq_num=%d bitmap_len=%d\n",
>  			    tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,
> -- 
> 2.34.1
> 

-- 
Kees Cook

Re: [PATCH v2 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len

[Brian Norris]

On Fri, Aug 25, 2023 at 2:10 PM Kees Cook <keescook@chromium.org> wrote:
> On Thu, Aug 24, 2023 at 09:10:45PM -0600, Gustavo A. R. Silva wrote:
> > +                     mwifiex_dbg(priv->adapter, WARN,
> > +                                 "TLV size (%zu) overflows event_buf buf_left=%d\n",
> > +                                 size_add(sizeof(tlv_rxba->header), tlv_len),
> > +                                 tlv_buf_left);
>
> With the suggested change to make this a warning and not dbg:

mwifiex_dbg(..., WARN, ...) *is* a warning, not a debug message. Or at
least, that's how it's used throughout this driver, even though it
actually yields a dev_info()-level message, regardless of the 'mask'
arg:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/net/wireless/marvell/mwifiex/main.c?id=v6.4#n1811

Re: [PATCH v2 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len

[Kees Cook]

On Fri, Aug 25, 2023 at 04:38:56PM -0700, Brian Norris wrote:
> On Fri, Aug 25, 2023 at 2:10 PM Kees Cook <keescook@chromium.org> wrote:
> > On Thu, Aug 24, 2023 at 09:10:45PM -0600, Gustavo A. R. Silva wrote:
> > > +                     mwifiex_dbg(priv->adapter, WARN,
> > > +                                 "TLV size (%zu) overflows event_buf buf_left=%d\n",
> > > +                                 size_add(sizeof(tlv_rxba->header), tlv_len),
> > > +                                 tlv_buf_left);
> >
> > With the suggested change to make this a warning and not dbg:
> 
> mwifiex_dbg(..., WARN, ...) *is* a warning, not a debug message. Or at
> least, that's how it's used throughout this driver, even though it
> actually yields a dev_info()-level message, regardless of the 'mask'
> arg:

Oh duh. My eyes didn't get any further than "dbg". My bad! Yes, this is
good as-is. :) Sorry for the noise!

-Kees

-- 
Kees Cook