* [PATCH for-4.14 0/2] brcmfmac: scan related fixes
@ 2017-09-12 8:47 Arend van Spriel
2017-09-12 8:47 ` [PATCH for-4.14 1/2] brcmfmac: add length check in brcmf_cfg80211_escan_handler() Arend van Spriel
2017-09-12 8:47 ` [PATCH for-4.14 2/2] brcmfmac: setup passive scan if requested by user-space Arend van Spriel
0 siblings, 2 replies; 4+ messages in thread
From: Arend van Spriel @ 2017-09-12 8:47 UTC (permalink / raw)
To: Kalle Valo; +Cc: linux-wireless, Arend van Spriel
Two patches related to scanning functionality in the driver. The first
patch addresses a security vulnerability in firmware notification
handling. The second one fixes a reported API issue in which the driver
ignored a passive scan request from user-space.
The patches apply to the master branch of the wireless-drivers
repository.
Arend van Spriel (2):
brcmfmac: add length check in brcmf_cfg80211_escan_handler()
brcmfmac: setup passive scan if requested by user-space
.../broadcom/brcm80211/brcmfmac/cfg80211.c | 37 +++++++++++-----------
.../broadcom/brcm80211/brcmfmac/fwil_types.h | 5 +++
2 files changed, 24 insertions(+), 18 deletions(-)
--
1.9.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH for-4.14 1/2] brcmfmac: add length check in brcmf_cfg80211_escan_handler()
2017-09-12 8:47 [PATCH for-4.14 0/2] brcmfmac: scan related fixes Arend van Spriel
@ 2017-09-12 8:47 ` Arend van Spriel
2017-09-20 4:47 ` [for-4.14, " Kalle Valo
2017-09-12 8:47 ` [PATCH for-4.14 2/2] brcmfmac: setup passive scan if requested by user-space Arend van Spriel
1 sibling, 1 reply; 4+ messages in thread
From: Arend van Spriel @ 2017-09-12 8:47 UTC (permalink / raw)
To: Kalle Valo; +Cc: linux-wireless, Arend van Spriel, Kevin Cernekee
Upon handling the firmware notification for scans the length was
checked properly and may result in corrupting kernel heap memory
due to buffer overruns. This fix addresses CVE-2017-0786.
Cc: stable@vger.kernel.org # v4.0.x
Cc: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
.../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index aaed4ab..26a0de3 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -3162,6 +3162,7 @@ static void brcmf_escan_timeout(unsigned long data)
struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
s32 status;
struct brcmf_escan_result_le *escan_result_le;
+ u32 escan_buflen;
struct brcmf_bss_info_le *bss_info_le;
struct brcmf_bss_info_le *bss = NULL;
u32 bi_length;
@@ -3181,11 +3182,23 @@ static void brcmf_escan_timeout(unsigned long data)
if (status == BRCMF_E_STATUS_PARTIAL) {
brcmf_dbg(SCAN, "ESCAN Partial result\n");
+ if (e->datalen < sizeof(*escan_result_le)) {
+ brcmf_err("invalid event data length\n");
+ goto exit;
+ }
escan_result_le = (struct brcmf_escan_result_le *) data;
if (!escan_result_le) {
brcmf_err("Invalid escan result (NULL pointer)\n");
goto exit;
}
+ escan_buflen = le32_to_cpu(escan_result_le->buflen);
+ if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||
+ escan_buflen > e->datalen ||
+ escan_buflen < sizeof(*escan_result_le)) {
+ brcmf_err("Invalid escan buffer length: %d\n",
+ escan_buflen);
+ goto exit;
+ }
if (le16_to_cpu(escan_result_le->bss_count) != 1) {
brcmf_err("Invalid bss_count %d: ignoring\n",
escan_result_le->bss_count);
@@ -3202,9 +3215,8 @@ static void brcmf_escan_timeout(unsigned long data)
}
bi_length = le32_to_cpu(bss_info_le->length);
- if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
- WL_ESCAN_RESULTS_FIXED_SIZE)) {
- brcmf_err("Invalid bss_info length %d: ignoring\n",
+ if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
+ brcmf_err("Ignoring invalid bss_info length: %d\n",
bi_length);
goto exit;
}
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH for-4.14 2/2] brcmfmac: setup passive scan if requested by user-space
2017-09-12 8:47 [PATCH for-4.14 0/2] brcmfmac: scan related fixes Arend van Spriel
2017-09-12 8:47 ` [PATCH for-4.14 1/2] brcmfmac: add length check in brcmf_cfg80211_escan_handler() Arend van Spriel
@ 2017-09-12 8:47 ` Arend van Spriel
1 sibling, 0 replies; 4+ messages in thread
From: Arend van Spriel @ 2017-09-12 8:47 UTC (permalink / raw)
To: Kalle Valo; +Cc: linux-wireless, Arend van Spriel
The driver was not properly configuring firmware with regard to the
type of scan. It always performed an active scan even when user-space
was requesting for passive scan, ie. the scan request was done without
any SSIDs specified.
Cc: stable@vger.kernel.org # v4.0.x
Reported-by: Huang, Jiangyang <Jiangyang.Huang@itron.com>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
.../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 19 ++++---------------
.../wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | 5 +++++
2 files changed, 9 insertions(+), 15 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 26a0de3..4157c90 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -980,7 +980,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
eth_broadcast_addr(params_le->bssid);
params_le->bss_type = DOT11_BSSTYPE_ANY;
- params_le->scan_type = 0;
+ params_le->scan_type = BRCMF_SCANTYPE_ACTIVE;
params_le->channel_num = 0;
params_le->nprobes = cpu_to_le32(-1);
params_le->active_time = cpu_to_le32(-1);
@@ -988,12 +988,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
params_le->home_time = cpu_to_le32(-1);
memset(¶ms_le->ssid_le, 0, sizeof(params_le->ssid_le));
- /* if request is null exit so it will be all channel broadcast scan */
- if (!request)
- return;
-
n_ssids = request->n_ssids;
n_channels = request->n_channels;
+
/* Copy channel array if applicable */
brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n",
n_channels);
@@ -1030,16 +1027,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg,
ptr += sizeof(ssid_le);
}
} else {
- brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids);
- if ((request->ssids) && request->ssids->ssid_len) {
- brcmf_dbg(SCAN, "SSID %s len=%d\n",
- params_le->ssid_le.SSID,
- request->ssids->ssid_len);
- params_le->ssid_le.SSID_len =
- cpu_to_le32(request->ssids->ssid_len);
- memcpy(¶ms_le->ssid_le.SSID, request->ssids->ssid,
- request->ssids->ssid_len);
- }
+ brcmf_dbg(SCAN, "Performing passive scan\n");
+ params_le->scan_type = BRCMF_SCANTYPE_PASSIVE;
}
/* Adding mask to channel numbers */
params_le->channel_num =
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index 8391989..e0d22fe 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -45,6 +45,11 @@
#define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff
#define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16
+/* scan type definitions */
+#define BRCMF_SCANTYPE_DEFAULT 0xFF
+#define BRCMF_SCANTYPE_ACTIVE 0
+#define BRCMF_SCANTYPE_PASSIVE 1
+
#define BRCMF_WSEC_MAX_PSK_LEN 32
#define BRCMF_WSEC_PASSPHRASE BIT(0)
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [for-4.14, 1/2] brcmfmac: add length check in brcmf_cfg80211_escan_handler()
2017-09-12 8:47 ` [PATCH for-4.14 1/2] brcmfmac: add length check in brcmf_cfg80211_escan_handler() Arend van Spriel
@ 2017-09-20 4:47 ` Kalle Valo
0 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2017-09-20 4:47 UTC (permalink / raw)
To: Arend Van Spriel; +Cc: linux-wireless, Arend van Spriel, Kevin Cernekee
Arend Van Spriel <arend.vanspriel@broadcom.com> wrote:
> Upon handling the firmware notification for scans the length was
> checked properly and may result in corrupting kernel heap memory
> due to buffer overruns. This fix addresses CVE-2017-0786.
>
> Cc: stable@vger.kernel.org # v4.0.x
> Cc: Kevin Cernekee <cernekee@chromium.org>
> Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
> Reviewed-by: Franky Lin <franky.lin@broadcom.com>
> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
2 patches applied to wireless-drivers.git, thanks.
17df6453d4be brcmfmac: add length check in brcmf_cfg80211_escan_handler()
35f62727df0e brcmfmac: setup passive scan if requested by user-space
--
https://patchwork.kernel.org/patch/9948689/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-09-20 4:47 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-09-12 8:47 [PATCH for-4.14 0/2] brcmfmac: scan related fixes Arend van Spriel
2017-09-12 8:47 ` [PATCH for-4.14 1/2] brcmfmac: add length check in brcmf_cfg80211_escan_handler() Arend van Spriel
2017-09-20 4:47 ` [for-4.14, " Kalle Valo
2017-09-12 8:47 ` [PATCH for-4.14 2/2] brcmfmac: setup passive scan if requested by user-space Arend van Spriel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.