From: Luca Coelho <luca@coelho.fi>
To: kvalo@codeaurora.org
Cc: linux-wireless@vger.kernel.org
Subject: [PATCH v2 20/47] iwlwifi: validate MPDU length against notification length
Date: Wed, 9 Dec 2020 23:16:24 +0200 [thread overview]
Message-ID: <iwlwifi.20201209231352.7c721ad37014.Id5746874ecfa208b60baa62691b2d9dc5dd4d89c@changeid> (raw)
In-Reply-To: <20201209211651.968276-1-luca@coelho.fi>
From: Johannes Berg <johannes.berg@intel.com>
The MPDU contained in a notification shouldn't be larger than the
notification size itself is, validate this.
Reported-by: Haggai Abramovsky <haggai.abramovsky@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
drivers/net/wireless/intel/iwlwifi/dvm/rx.c | 10 ++++++++--
drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 8 +++++++-
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 6 ++++++
3 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
index 9d55ece05020..d06278558b33 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
@@ -3,7 +3,7 @@
*
* Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
* Copyright(c) 2015 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018, 2020 Intel Corporation
*
* Portions of this file are derived from the ipw3945 project, as well
* as portionhelp of the ieee80211 subsystem header files.
@@ -786,7 +786,7 @@ static void iwlagn_rx_reply_rx(struct iwl_priv *priv,
struct iwl_rx_phy_res *phy_res;
__le32 rx_pkt_status;
struct iwl_rx_mpdu_res_start *amsdu;
- u32 len;
+ u32 len, pkt_len = iwl_rx_packet_len(pkt);
u32 ampdu_status;
u32 rate_n_flags;
@@ -798,6 +798,12 @@ static void iwlagn_rx_reply_rx(struct iwl_priv *priv,
amsdu = (struct iwl_rx_mpdu_res_start *)pkt->data;
header = (struct ieee80211_hdr *)(pkt->data + sizeof(*amsdu));
len = le16_to_cpu(amsdu->byte_count);
+
+ if (unlikely(len + sizeof(*amsdu) + sizeof(__le32) > pkt_len)) {
+ IWL_DEBUG_DROP(priv, "FW lied about packet len\n");
+ return;
+ }
+
rx_pkt_status = *(__le32 *)(pkt->data + sizeof(*amsdu) + len);
ampdu_status = iwlagn_translate_rx_status(priv,
le32_to_cpu(rx_pkt_status));
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 2ffe92d79148..af3151553569 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -349,7 +349,7 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
struct iwl_rx_mpdu_res_start *rx_res;
struct ieee80211_sta *sta = NULL;
struct sk_buff *skb;
- u32 len;
+ u32 len, pkt_len = iwl_rx_packet_payload_len(pkt);
u32 rate_n_flags;
u32 rx_pkt_status;
u8 crypt_len = 0;
@@ -358,6 +358,12 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi,
rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data;
hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res));
len = le16_to_cpu(rx_res->byte_count);
+
+ if (unlikely(len + sizeof(*rx_res) + sizeof(__le32) > pkt_len)) {
+ IWL_DEBUG_DROP(mvm, "FW lied about packet len\n");
+ return;
+ }
+
rx_pkt_status = get_unaligned_le32((__le32 *)
(pkt->data + sizeof(*rx_res) + len));
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 22bd3a84aaac..1d51ec95ec21 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -1607,6 +1607,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
struct iwl_rx_mpdu_desc *desc = (void *)pkt->data;
struct ieee80211_hdr *hdr;
u32 len = le16_to_cpu(desc->mpdu_len);
+ u32 pkt_len = iwl_rx_packet_payload_len(pkt);
u32 rate_n_flags, gp2_on_air_rise;
u16 phy_info = le16_to_cpu(desc->phy_info);
struct ieee80211_sta *sta = NULL;
@@ -1653,6 +1654,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi,
le32_get_bits(phy_data.d1,
IWL_RX_PHY_DATA1_INFO_TYPE_MASK);
+ if (len + desc_size > pkt_len) {
+ IWL_DEBUG_DROP(mvm, "FW lied about packet len\n");
+ return;
+ }
+
hdr = (void *)(pkt->data + desc_size);
/* Dont use dev_alloc_skb(), we'll have enough headroom once
* ieee80211_hdr pulled.
--
2.29.2
next prev parent reply other threads:[~2020-12-09 21:27 UTC|newest]
Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-09 21:16 [PATCH v2 00/47] iwlwifi: final patches for v5.11 2020-12-09 Luca Coelho
2020-12-09 21:16 ` [PATCH v2 01/47] iwlwifi: remove all queue resources before free Luca Coelho
2020-12-09 22:11 ` Luca Coelho
2020-12-09 21:16 ` [PATCH v2 02/47] iwlwifi: yoyo: add the ability to dump phy periphery Luca Coelho
2020-12-09 21:16 ` [PATCH v2 03/47] iwlwifi: yoyo: align the write pointer to DWs Luca Coelho
2020-12-09 21:16 ` [PATCH v2 04/47] iwlwifi: mvm: fix sar profile printing issue Luca Coelho
2020-12-09 21:16 ` [PATCH v2 05/47] iwlwifi: move reclaim flows to the queue file Luca Coelho
2020-12-09 21:16 ` [PATCH v2 06/47] iwlwifi: d3: do not send the WOWLAN_CONFIGURATION command for netdetect Luca Coelho
2020-12-09 21:16 ` [PATCH v2 07/47] iwlwifi: update MAINTAINERS entry Luca Coelho
2020-12-09 21:16 ` [PATCH v2 08/47] iwlwifi: mvm: Init error table memory to zero Luca Coelho
2020-12-09 21:16 ` [PATCH v2 09/47] iwlwifi: mvm: remove the read_nvm from iwl_run_init_mvm_ucode Luca Coelho
2020-12-09 21:16 ` [PATCH v2 10/47] iwlwifi: pcie: remove obsolete pre-release support code Luca Coelho
2020-12-09 21:16 ` [PATCH v2 11/47] iwlwifi: copy iwl_he_capa for modifications Luca Coelho
2020-12-09 21:16 ` [PATCH v2 12/47] iwlwifi: mvm: add support for 6GHz Luca Coelho
2020-12-09 22:06 ` [PATCH v3 34/47] " Luca Coelho
2020-12-09 22:12 ` Luca Coelho
2020-12-09 21:16 ` [PATCH v2 13/47] iwlwifi: enable sending/setting debug host event Luca Coelho
2020-12-09 22:15 ` Luca Coelho
2020-12-09 21:16 ` [PATCH v2 14/47] iwlwifi: avoid endless HW errors at assert time Luca Coelho
2020-12-09 21:16 ` [PATCH v2 15/47] iwlwifi: mvm: remove the read_nvm from iwl_run_unified_mvm_ucode Luca Coelho
2020-12-09 21:16 ` [PATCH v2 16/47] iwlwifi: follow the new inclusive terminology Luca Coelho
2020-12-09 21:16 ` [PATCH v2 17/47] iwlwifi: fix typo in comment Luca Coelho
2020-12-09 21:16 ` [PATCH v2 18/47] iwlwifi: sort out the NVM offsets Luca Coelho
2020-12-09 21:16 ` [PATCH v2 19/47] iwlwifi: mvm: iterate active stations when updating statistics Luca Coelho
2020-12-09 21:16 ` Luca Coelho [this message]
2020-12-09 21:16 ` [PATCH v2 21/47] iwlwifi: pcie: validate RX descriptor length Luca Coelho
2020-12-09 21:16 ` [PATCH v2 22/47] iwlwifi: remove sw_csum_tx Luca Coelho
2020-12-09 21:16 ` [PATCH v2 23/47] iwlwifi: mvm: clear up iwl_mvm_notify_rx_queue() argument type Luca Coelho
2020-12-09 21:16 ` [PATCH v2 24/47] iwlwifi: mvm: move iwl_mvm_stop_device() out of line Luca Coelho
2020-12-09 21:16 ` [PATCH v2 25/47] iwlwifi: pcie: change 12k A-MSDU config to use 16k buffers Luca Coelho
2020-12-09 21:16 ` [PATCH v2 26/47] iwlwifi: mvm: fix 22000 series driver NMI Luca Coelho
2020-12-09 21:16 ` [PATCH v2 27/47] iwlwifi: mvm: do more useful queue sync accounting Luca Coelho
2020-12-09 21:16 ` [PATCH v2 28/47] iwlwifi: mvm: clean up scan state on failure Luca Coelho
2020-12-09 21:16 ` [PATCH v2 29/47] iwlwifi: pcie: remove MSIX_HW_INT_CAUSES_REG_IML handling Luca Coelho
2020-12-09 21:16 ` [PATCH v2 30/47] iwlwifi: fw: file: fix documentation for SAR flag Luca Coelho
2020-12-09 21:16 ` [PATCH v2 31/47] iwlwifi: pcie: remove unnecessary setting of inta_mask Luca Coelho
2020-12-09 21:16 ` [PATCH v2 32/47] iwlwifi: trans: consider firmware dead after errors Luca Coelho
2020-12-09 21:16 ` [PATCH v2 33/47] iwlwifi: dbg-tlv: fix old length in is_trig_data_contained() Luca Coelho
2020-12-09 21:16 ` [PATCH v2 34/47] iwlwifi: use SPDX tags Luca Coelho
2020-12-09 22:06 ` [PATCH v3 " Luca Coelho
2020-12-09 22:15 ` Luca Coelho
2020-12-09 21:16 ` [PATCH v2 35/47] iwlwifi: pcie: clean up some rx code Luca Coelho
2020-12-09 22:16 ` Luca Coelho
2020-12-09 21:16 ` [PATCH v2 36/47] iwlwifi: mvm: validate firmware sync response size Luca Coelho
2020-12-09 21:16 ` [PATCH v2 37/47] iwlwifi: mvm: fix a race in CSA that caused assert 0x3420 Luca Coelho
2020-12-09 21:16 ` [PATCH v2 38/47] iwlwifi: add an extra firmware state in the transport Luca Coelho
2020-12-09 21:16 ` [PATCH v2 39/47] iwlwifi: support firmware reset handshake Luca Coelho
2020-12-09 21:16 ` [PATCH v2 40/47] iwlwifi: mvm: disconnect if channel switch delay is too long Luca Coelho
2020-12-09 21:16 ` [PATCH v2 41/47] iwlwifi: Add a new card for MA family Luca Coelho
2020-12-09 21:16 ` [PATCH v2 42/47] iwlwifi: tighten RX MPDU bounds checks Luca Coelho
2020-12-09 21:16 ` [PATCH v2 43/47] iwlwifi: mvm: hook up missing RX handlers Luca Coelho
2020-12-09 21:16 ` [PATCH v2 44/47] iwlwifi: mvm: add size checks for range response notification Luca Coelho
2020-12-09 21:16 ` [PATCH v2 45/47] iwlwifi: mvm: check that statistics TLV version match struct version Luca Coelho
2020-12-09 21:16 ` [PATCH v2 46/47] iwlwifi: mvm: purge the BSS table upon firmware load Luca Coelho
2020-12-09 21:16 ` [PATCH v2 47/47] iwlwifi: mvm: validate notification size when waiting Luca Coelho
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=iwlwifi.20201209231352.7c721ad37014.Id5746874ecfa208b60baa62691b2d9dc5dd4d89c@changeid \
--to=luca@coelho.fi \
--cc=kvalo@codeaurora.org \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).