lkml.org 
[lkml]   [2017]   [Nov]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 183/294] brcmfmac: add length check in brcmf_cfg80211_escan_handler()
    3.16.50-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Arend Van Spriel <arend.vanspriel@broadcom.com>

    commit 17df6453d4be17910456e99c5a85025aa1b7a246 upstream.

    Upon handling the firmware notification for scans the length was
    checked properly and may result in corrupting kernel heap memory
    due to buffer overruns. This fix addresses CVE-2017-0786.

    Cc: Kevin Cernekee <cernekee@chromium.org>
    Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
    Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
    Reviewed-by: Franky Lin <franky.lin@broadcom.com>
    Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    [bwh: Backported to 3.16:
    - Use WL_ESCAN_BUF_SIZE instead of BRCMF_ESCAN_BUF_SIZE
    - Adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    .../wireless/brcm80211/brcmfmac/wl_cfg80211.c | 18 +++++++++++++++---
    1 file changed, 15 insertions(+), 3 deletions(-)

    --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
    +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
    @@ -2692,6 +2692,7 @@ brcmf_cfg80211_escan_handler(struct brcm
    s32 status;
    s32 err = 0;
    struct brcmf_escan_result_le *escan_result_le;
    + u32 escan_buflen;
    struct brcmf_bss_info_le *bss_info_le;
    struct brcmf_bss_info_le *bss = NULL;
    u32 bi_length;
    @@ -2708,11 +2709,23 @@ brcmf_cfg80211_escan_handler(struct brcm

    if (status == BRCMF_E_STATUS_PARTIAL) {
    brcmf_dbg(SCAN, "ESCAN Partial result\n");
    + if (e->datalen < sizeof(*escan_result_le)) {
    + brcmf_err("invalid event data length\n");
    + goto exit;
    + }
    escan_result_le = (struct brcmf_escan_result_le *) data;
    if (!escan_result_le) {
    brcmf_err("Invalid escan result (NULL pointer)\n");
    goto exit;
    }
    + escan_buflen = le32_to_cpu(escan_result_le->buflen);
    + if (escan_buflen > WL_ESCAN_BUF_SIZE ||
    + escan_buflen > e->datalen ||
    + escan_buflen < sizeof(*escan_result_le)) {
    + brcmf_err("Invalid escan buffer length: %d\n",
    + escan_buflen);
    + goto exit;
    + }
    if (le16_to_cpu(escan_result_le->bss_count) != 1) {
    brcmf_err("Invalid bss_count %d: ignoring\n",
    escan_result_le->bss_count);
    @@ -2729,9 +2742,8 @@ brcmf_cfg80211_escan_handler(struct brcm
    }

    bi_length = le32_to_cpu(bss_info_le->length);
    - if (bi_length != (le32_to_cpu(escan_result_le->buflen) -
    - WL_ESCAN_RESULTS_FIXED_SIZE)) {
    - brcmf_err("Invalid bss_info length %d: ignoring\n",
    + if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) {
    + brcmf_err("Ignoring invalid bss_info length: %d\n",
    bi_length);
    goto exit;
    }
    \
     
     \ /
      Last update: 2017-11-08 20:58    [W:4.197 / U:0.288 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site