diff options
Diffstat (limited to 'Buffer-overflow-read-checks-in-mwifiex.patch')
| -rw-r--r-- | Buffer-overflow-read-checks-in-mwifiex.patch | 238 |
1 files changed, 0 insertions, 238 deletions
diff --git a/Buffer-overflow-read-checks-in-mwifiex.patch b/Buffer-overflow-read-checks-in-mwifiex.patch deleted file mode 100644 index 00ae1fa9c..000000000 --- a/Buffer-overflow-read-checks-in-mwifiex.patch +++ /dev/null @@ -1,238 +0,0 @@ -From patchwork Wed May 29 12:52:19 2019 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -X-Patchwork-Submitter: Takashi Iwai <tiwai@suse.de> -X-Patchwork-Id: 10967049 -X-Patchwork-Delegate: kvalo@adurom.com -Return-Path: <linux-wireless-owner@kernel.org> -Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org - [172.30.200.125]) - by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3C6B01575 - for <patchwork-linux-wireless@patchwork.kernel.org>; - Wed, 29 May 2019 12:52:41 +0000 (UTC) -Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) - by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2FD42287D4 - for <patchwork-linux-wireless@patchwork.kernel.org>; - Wed, 29 May 2019 12:52:41 +0000 (UTC) -Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) - id 2E25D2897A; Wed, 29 May 2019 12:52:41 +0000 (UTC) -X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on - pdx-wl-mail.web.codeaurora.org -X-Spam-Level: -X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, - RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 -Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) - by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A60B52895F - for <patchwork-linux-wireless@patchwork.kernel.org>; - Wed, 29 May 2019 12:52:40 +0000 (UTC) -Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand - id S1727034AbfE2Mwk (ORCPT - <rfc822;patchwork-linux-wireless@patchwork.kernel.org>); - Wed, 29 May 2019 08:52:40 -0400 -Received: from mx2.suse.de ([195.135.220.15]:33780 "EHLO mx1.suse.de" - rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP - id S1725936AbfE2Mwj (ORCPT <rfc822;linux-wireless@vger.kernel.org>); - Wed, 29 May 2019 08:52:39 -0400 -X-Virus-Scanned: by amavisd-new at test-mx.suse.de -Received: from relay2.suse.de (unknown [195.135.220.254]) - by mx1.suse.de (Postfix) with ESMTP id EA4CCB00B; - Wed, 29 May 2019 12:52:37 +0000 (UTC) -From: Takashi Iwai <tiwai@suse.de> -To: linux-wireless@vger.kernel.org -Cc: Amitkumar Karwar <amitkarwar@gmail.com>, - Nishant Sarmukadam <nishants@marvell.com>, - Ganapathi Bhat <gbhat@marvell.com>, - Xinming Hu <huxinming820@gmail.com>, - Kalle Valo <kvalo@codeaurora.org>, huangwen@venustech.com.cn, - Solar Designer <solar@openwall.com>, - Marcus Meissner <meissner@suse.de> -Subject: [PATCH 1/2] mwifiex: Fix possible buffer overflows at parsing bss - descriptor -Date: Wed, 29 May 2019 14:52:19 +0200 -Message-Id: <20190529125220.17066-2-tiwai@suse.de> -X-Mailer: git-send-email 2.16.4 -In-Reply-To: <20190529125220.17066-1-tiwai@suse.de> -References: <20190529125220.17066-1-tiwai@suse.de> -Sender: linux-wireless-owner@vger.kernel.org -Precedence: bulk -List-ID: <linux-wireless.vger.kernel.org> -X-Mailing-List: linux-wireless@vger.kernel.org -X-Virus-Scanned: ClamAV using ClamSMTP - -mwifiex_update_bss_desc_with_ie() calls memcpy() unconditionally in -a couple places without checking the destination size. Since the -source is given from user-space, this may trigger a heap buffer -overflow. - -Fix it by putting the length check before performing memcpy(). - -This fix addresses CVE-2019-3846. - -Reported-by: huangwen <huangwen@venustech.com.cn> -Signed-off-by: Takashi Iwai <tiwai@suse.de> ---- - drivers/net/wireless/marvell/mwifiex/scan.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c -index 935778ec9a1b..64ab6fe78c0d 100644 ---- a/drivers/net/wireless/marvell/mwifiex/scan.c -+++ b/drivers/net/wireless/marvell/mwifiex/scan.c -@@ -1247,6 +1247,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - } - switch (element_id) { - case WLAN_EID_SSID: -+ if (element_len > IEEE80211_MAX_SSID_LEN) -+ return -EINVAL; - bss_entry->ssid.ssid_len = element_len; - memcpy(bss_entry->ssid.ssid, (current_ptr + 2), - element_len); -@@ -1256,6 +1258,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_SUPP_RATES: -+ if (element_len > MWIFIEX_SUPPORTED_RATES) -+ return -EINVAL; - memcpy(bss_entry->data_rates, current_ptr + 2, - element_len); - memcpy(bss_entry->supported_rates, current_ptr + 2, - -From patchwork Wed May 29 12:52:20 2019 -Content-Type: text/plain; charset="utf-8" -MIME-Version: 1.0 -Content-Transfer-Encoding: 7bit -X-Patchwork-Submitter: Takashi Iwai <tiwai@suse.de> -X-Patchwork-Id: 10967047 -X-Patchwork-Delegate: kvalo@adurom.com -Return-Path: <linux-wireless-owner@kernel.org> -Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org - [172.30.200.125]) - by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 05B0D92A - for <patchwork-linux-wireless@patchwork.kernel.org>; - Wed, 29 May 2019 12:52:41 +0000 (UTC) -Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) - by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EB3CC28972 - for <patchwork-linux-wireless@patchwork.kernel.org>; - Wed, 29 May 2019 12:52:40 +0000 (UTC) -Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) - id DF23B28978; Wed, 29 May 2019 12:52:40 +0000 (UTC) -X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on - pdx-wl-mail.web.codeaurora.org -X-Spam-Level: -X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, - RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 -Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) - by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8221B20121 - for <patchwork-linux-wireless@patchwork.kernel.org>; - Wed, 29 May 2019 12:52:40 +0000 (UTC) -Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand - id S1727023AbfE2Mwj (ORCPT - <rfc822;patchwork-linux-wireless@patchwork.kernel.org>); - Wed, 29 May 2019 08:52:39 -0400 -Received: from mx2.suse.de ([195.135.220.15]:33796 "EHLO mx1.suse.de" - rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP - id S1727017AbfE2Mwj (ORCPT <rfc822;linux-wireless@vger.kernel.org>); - Wed, 29 May 2019 08:52:39 -0400 -X-Virus-Scanned: by amavisd-new at test-mx.suse.de -Received: from relay2.suse.de (unknown [195.135.220.254]) - by mx1.suse.de (Postfix) with ESMTP id 06E82B010; - Wed, 29 May 2019 12:52:38 +0000 (UTC) -From: Takashi Iwai <tiwai@suse.de> -To: linux-wireless@vger.kernel.org -Cc: Amitkumar Karwar <amitkarwar@gmail.com>, - Nishant Sarmukadam <nishants@marvell.com>, - Ganapathi Bhat <gbhat@marvell.com>, - Xinming Hu <huxinming820@gmail.com>, - Kalle Valo <kvalo@codeaurora.org>, huangwen@venustech.com.cn, - Solar Designer <solar@openwall.com>, - Marcus Meissner <meissner@suse.de> -Subject: [PATCH 2/2] mwifiex: Abort at too short BSS descriptor element -Date: Wed, 29 May 2019 14:52:20 +0200 -Message-Id: <20190529125220.17066-3-tiwai@suse.de> -X-Mailer: git-send-email 2.16.4 -In-Reply-To: <20190529125220.17066-1-tiwai@suse.de> -References: <20190529125220.17066-1-tiwai@suse.de> -Sender: linux-wireless-owner@vger.kernel.org -Precedence: bulk -List-ID: <linux-wireless.vger.kernel.org> -X-Mailing-List: linux-wireless@vger.kernel.org -X-Virus-Scanned: ClamAV using ClamSMTP - -Currently mwifiex_update_bss_desc_with_ie() implicitly assumes that -the source descriptor entries contain the enough size for each type -and performs copying without checking the source size. This may lead -to read over boundary. - -Fix this by putting the source size check in appropriate places. - -Signed-off-by: Takashi Iwai <tiwai@suse.de> ---- - drivers/net/wireless/marvell/mwifiex/scan.c | 15 +++++++++++++++ - 1 file changed, 15 insertions(+) - -diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c -index 64ab6fe78c0d..c269a0de9413 100644 ---- a/drivers/net/wireless/marvell/mwifiex/scan.c -+++ b/drivers/net/wireless/marvell/mwifiex/scan.c -@@ -1269,6 +1269,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_FH_PARAMS: -+ if (element_len + 2 < sizeof(*fh_param_set)) -+ return -EINVAL; - fh_param_set = - (struct ieee_types_fh_param_set *) current_ptr; - memcpy(&bss_entry->phy_param_set.fh_param_set, -@@ -1277,6 +1279,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_DS_PARAMS: -+ if (element_len + 2 < sizeof(*ds_param_set)) -+ return -EINVAL; - ds_param_set = - (struct ieee_types_ds_param_set *) current_ptr; - -@@ -1288,6 +1292,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_CF_PARAMS: -+ if (element_len + 2 < sizeof(*cf_param_set)) -+ return -EINVAL; - cf_param_set = - (struct ieee_types_cf_param_set *) current_ptr; - memcpy(&bss_entry->ss_param_set.cf_param_set, -@@ -1296,6 +1302,8 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_IBSS_PARAMS: -+ if (element_len + 2 < sizeof(*ibss_param_set)) -+ return -EINVAL; - ibss_param_set = - (struct ieee_types_ibss_param_set *) - current_ptr; -@@ -1305,10 +1313,14 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_ERP_INFO: -+ if (!element_len) -+ return -EINVAL; - bss_entry->erp_flags = *(current_ptr + 2); - break; - - case WLAN_EID_PWR_CONSTRAINT: -+ if (!element_len) -+ return -EINVAL; - bss_entry->local_constraint = *(current_ptr + 2); - bss_entry->sensed_11h = true; - break; -@@ -1349,6 +1361,9 @@ int mwifiex_update_bss_desc_with_ie(struct mwifiex_adapter *adapter, - break; - - case WLAN_EID_VENDOR_SPECIFIC: -+ if (element_len + 2 < sizeof(vendor_ie->vend_hdr)) -+ return -EINVAL; -+ - vendor_ie = (struct ieee_types_vendor_specific *) - current_ptr; - |