* Patch "brcmfmac: add length check in brcmf_cfg80211_escan_handler()" has been added to the 4.4-stable tree
@ 2017-10-10 18:16 gregkh
2017-10-10 19:31 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: gregkh @ 2017-10-10 18:16 UTC (permalink / raw)
To: arend.vanspriel, cernekee, franky.lin, gregkh, hante.meuleman,
kvalo, pieter-paul.giesberts
Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
brcmfmac: add length check in brcmf_cfg80211_escan_handler()
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
brcmfmac-add-length-check-in-brcmf_cfg80211_escan_handler.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 17df6453d4be17910456e99c5a85025aa1b7a246 Mon Sep 17 00:00:00 2001
From: Arend Van Spriel <arend.vanspriel@broadcom.com>
Date: Tue, 12 Sep 2017 10:47:53 +0200
Subject: brcmfmac: add length check in brcmf_cfg80211_escan_handler()
From: Arend Van Spriel <arend.vanspriel@broadcom.com>
commit 17df6453d4be17910456e99c5a85025aa1b7a246 upstream.
Upon handling the firmware notification for scans the length was
checked properly and may result in corrupting kernel heap memory
due to buffer overruns. This fix addresses CVE-2017-0786.
Cc: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -2914,6 +2914,7 @@ brcmf_cfg80211_escan_handler(struct brcm
struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
s32 status;
struct brcmf_escan_result_le *escan_result_le;
+ u32 escan_buflen;
struct brcmf_bss_info_le *bss_info_le;
struct brcmf_bss_info_le *bss = NULL;
u32 bi_length;
@@ -2930,11 +2931,23 @@ brcmf_cfg80211_escan_handler(struct brcm
if (status == BRCMF_E_STATUS_PARTIAL) {
brcmf_dbg(SCAN, "ESCAN Partial result\n");
+ if (e->datalen < sizeof(*escan_result_le)) {
+ brcmf_err("invalid event data length\n");
+ goto exit;
+ }
escan_result_le = (struct brcmf_escan_result_le *) data;
if (!escan_result_le) {
brcmf_err("Invalid escan result (NULL pointer)\n");
goto exit;
}
+ escan_buflen = le32_to_cpu(escan_result_le->buflen);
+ if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
+ escan_buflen > e->datalen ||
+ escan_buflen < sizeof(*escan_result_le)) {
+ brcmf_err("Invalid escan buffer length: %d\n",
+ escan_buflen);
+ goto exit;
+ }
if (le16_to_cpu(escan_result_le->bss_count) != 1) {
brcmf_err("Invalid bss_count %d: ignoring\n",
escan_result_le->bss_count);
@@ -2951,9 +2964,8 @@ brcmf_cfg80211_escan_handler(struct brcm
}
bi_length = le32_to_cpu(bss_info_le->length);
- if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
- WL_ESCAN_RESULTS_FIXED_SIZE)) {
- brcmf_err("Invalid bss_info length %d: ignoring\n",
+ if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
+ brcmf_err("Ignoring invalid bss_info length: %d\n",
bi_length);
goto exit;
}
Patches currently in stable-queue which might be from arend.vanspriel@broadcom.com are
queue-4.4/brcmfmac-add-length-check-in-brcmf_cfg80211_escan_handler.patch
queue-4.4/brcmfmac-setup-passive-scan-if-requested-by-user-space.patch
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Patch "brcmfmac: add length check in brcmf_cfg80211_escan_handler()" has been added to the 4.4-stable tree
2017-10-10 18:16 Patch "brcmfmac: add length check in brcmf_cfg80211_escan_handler()" has been added to the 4.4-stable tree gregkh
@ 2017-10-10 19:31 ` Greg KH
2017-10-12 9:14 ` Arend van Spriel
0 siblings, 1 reply; 4+ messages in thread
From: Greg KH @ 2017-10-10 19:31 UTC (permalink / raw)
To: arend.vanspriel, cernekee, franky.lin, hante.meuleman, kvalo,
pieter-paul.giesberts
Cc: stable, stable-commits
On Tue, Oct 10, 2017 at 08:16:17PM +0200, gregkh@linuxfoundation.org wrote:
>
> This is a note to let you know that I've just added the patch titled
>
> brcmfmac: add length check in brcmf_cfg80211_escan_handler()
>
> to the 4.4-stable tree which can be found at:
> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>
> The filename of the patch is:
> brcmfmac-add-length-check-in-brcmf_cfg80211_escan_handler.patch
> and it can be found in the queue-4.4 subdirectory.
>
> If you, or anyone else, feels it should not be added to the stable tree,
> please let <stable@vger.kernel.org> know about it.
>
Nope, breaks the build. If this should go to 4.4, can someone please
provide a working backport for it?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Patch "brcmfmac: add length check in brcmf_cfg80211_escan_handler()" has been added to the 4.4-stable tree
2017-10-10 19:31 ` Greg KH
@ 2017-10-12 9:14 ` Arend van Spriel
0 siblings, 0 replies; 4+ messages in thread
From: Arend van Spriel @ 2017-10-12 9:14 UTC (permalink / raw)
To: Greg KH, cernekee, franky.lin, hante.meuleman, kvalo,
pieter-paul.giesberts
Cc: stable, stable-commits
On 10-10-17 21:31, Greg KH wrote:
> On Tue, Oct 10, 2017 at 08:16:17PM +0200, gregkh@linuxfoundation.org wrote:
>>
>> This is a note to let you know that I've just added the patch titled
>>
>> brcmfmac: add length check in brcmf_cfg80211_escan_handler()
>>
>> to the 4.4-stable tree which can be found at:
>> http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
>>
>> The filename of the patch is:
>> brcmfmac-add-length-check-in-brcmf_cfg80211_escan_handler.patch
>> and it can be found in the queue-4.4 subdirectory.
>>
>> If you, or anyone else, feels it should not be added to the stable tree,
>> please let <stable@vger.kernel.org> know about it.
>>
>
> Nope, breaks the build. If this should go to 4.4, can someone please
> provide a working backport for it?
been on sick leave, but I will look into it.
Thanks,
Arend
^ permalink raw reply [flat|nested] 4+ messages in thread
* Patch "brcmfmac: add length check in brcmf_cfg80211_escan_handler()" has been added to the 4.4-stable tree
@ 2017-10-12 11:58 gregkh
0 siblings, 0 replies; 4+ messages in thread
From: gregkh @ 2017-10-12 11:58 UTC (permalink / raw)
To: arend.vanspriel, cernekee, franky.lin, gregkh, hante.meuleman,
kvalo, pieter-paul.giesberts
Cc: stable, stable-commits
This is a note to let you know that I've just added the patch titled
brcmfmac: add length check in brcmf_cfg80211_escan_handler()
to the 4.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
brcmfmac-add-length-check-in-brcmf_cfg80211_escan_handler.patch
and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
>From 17df6453d4be17910456e99c5a85025aa1b7a246 Mon Sep 17 00:00:00 2001
From: Arend Van Spriel <arend.vanspriel@broadcom.com>
Date: Tue, 12 Sep 2017 10:47:53 +0200
Subject: brcmfmac: add length check in brcmf_cfg80211_escan_handler()
From: Arend Van Spriel <arend.vanspriel@broadcom.com>
commit 17df6453d4be17910456e99c5a85025aa1b7a246 upstream.
Upon handling the firmware notification for scans the length was
checked properly and may result in corrupting kernel heap memory
due to buffer overruns. This fix addresses CVE-2017-0786.
Cc: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -2903,6 +2903,7 @@ brcmf_cfg80211_escan_handler(struct brcm
struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
s32 status;
struct brcmf_escan_result_le *escan_result_le;
+ u32 escan_buflen;
struct brcmf_bss_info_le *bss_info_le;
struct brcmf_bss_info_le *bss = NULL;
u32 bi_length;
@@ -2919,11 +2920,23 @@ brcmf_cfg80211_escan_handler(struct brcm
if (status == BRCMF_E_STATUS_PARTIAL) {
brcmf_dbg(SCAN, "ESCAN Partial result\n");
+ if (e->datalen < sizeof(*escan_result_le)) {
+ brcmf_err("invalid event data length\n");
+ goto exit;
+ }
escan_result_le = (struct brcmf_escan_result_le *) data;
if (!escan_result_le) {
brcmf_err("Invalid escan result (NULL pointer)\n");
goto exit;
}
+ escan_buflen = le32_to_cpu(escan_result_le->buflen);
+ if (escan_buflen > WL_ESCAN_BUF_SIZE ||
+ escan_buflen > e->datalen ||
+ escan_buflen < sizeof(*escan_result_le)) {
+ brcmf_err("Invalid escan buffer length: %d\n",
+ escan_buflen);
+ goto exit;
+ }
if (le16_to_cpu(escan_result_le->bss_count) != 1) {
brcmf_err("Invalid bss_count %d: ignoring\n",
escan_result_le->bss_count);
@@ -2940,9 +2953,8 @@ brcmf_cfg80211_escan_handler(struct brcm
}
bi_length = le32_to_cpu(bss_info_le->length);
- if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
- WL_ESCAN_RESULTS_FIXED_SIZE)) {
- brcmf_err("Invalid bss_info length %d: ignoring\n",
+ if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
+ brcmf_err("Ignoring invalid bss_info length: %d\n",
bi_length);
goto exit;
}
Patches currently in stable-queue which might be from arend.vanspriel@broadcom.com are
queue-4.4/brcmfmac-add-length-check-in-brcmf_cfg80211_escan_handler.patch
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-10-12 11:58 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-10-10 18:16 Patch "brcmfmac: add length check in brcmf_cfg80211_escan_handler()" has been added to the 4.4-stable tree gregkh
2017-10-10 19:31 ` Greg KH
2017-10-12 9:14 ` Arend van Spriel
-- strict thread matches above, loose matches on Subject: below --
2017-10-12 11:58 gregkh
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).