From 5bc7e5a20ab627ff515c0838b60f142a41701ebf Mon Sep 17 00:00:00 2001 From: Carter Chen Date: Fri, 2 Sep 2022 02:20:39 -0500 Subject: [PATCH 111/296] brcmfmac: add sanity check for potential underflow and overflow Signed-off-by: Carter Chen --- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 24 +++++++++++++++---- .../broadcom/brcm80211/brcmfmac/fwsignal.c | 2 +- 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index 36b85ee00636..99ee4e18871e 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -2312,7 +2312,7 @@ brcmf_set_wsec_mode(struct net_device *ndev, if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_GCMP)) { brcmf_dbg(CONN, - "set_wsdec_info algos (0x%x) mask (0x%x)\n", + "set_wsec_info algos (0x%x) mask (0x%x)\n", algos, mask); err = wl_set_wsec_info_algos(ifp, algos, mask); if (err) { @@ -4133,6 +4133,13 @@ static struct cfg80211_scan_request * brcmf_alloc_internal_escan_request(struct wiphy *wiphy, u32 n_netinfo) { struct cfg80211_scan_request *req; size_t req_size; + size_t size_sanity = ~0; + + if (n_netinfo > ((size_sanity - sizeof(*req)) / + (sizeof(req->channels[0]) + sizeof(*req->ssids)))) { + brcmf_err("requesting a huge count:%d\n", n_netinfo); + return NULL; + } req_size = sizeof(*req) + n_netinfo * sizeof(req->channels[0]) + @@ -4283,9 +4290,18 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp, } netinfo_start = brcmf_get_netinfo_array(pfn_result); - datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result); - if (datalen < result_count * sizeof(*netinfo)) { - bphy_err(drvr, "insufficient event data\n"); + /* To make sure e->datalen is big enough */ + if (e->datalen >= ((void *)netinfo_start - (void *)pfn_result)) { + u32 cnt_sanity = ~0; + + datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result); + if (datalen < result_count * sizeof(*netinfo) || + (result_count > cnt_sanity / sizeof(*netinfo))) { + brcmf_err("insufficient event data\n"); + goto out_err; + } + } else { + brcmf_err("insufficient event data\n"); goto out_err; } diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c index 3ac7da427521..ad38dff09d00 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c @@ -1847,7 +1847,7 @@ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb) u8 *signal_data; s16 data_len; u8 type; - u8 len; + s16 len; u8 *data; s32 status; s32 err; -- 2.25.1