[PATCH wireless-next 2/3] wifi: nxpwifi: reject VDLL blocks that do not fit the command buffer
Linmao Li <[email protected]>
| Newsgroups | org.kernel.vger.linux-wireless,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
nxpwifi_download_vdll_block() copies block_len bytes into ctrl->skb, a
single NXPWIFI_SIZE_OF_CMD_BUFFER byte buffer allocated once at init
time. block_len comes from the VDLL indication event and is clamped
only against the length of the VDLL image, which is taken from the
firmware file and is far larger than the command buffer.
Two things go wrong once a block exceeds it. msg_len is a u16, so a
block_len near 65535 wraps it to a small value: skb_put_zero() then
reserves a few bytes while the memcpy() below still writes block_len
bytes past the end of the buffer. Without the wrap, skb_put_zero()
itself runs past the tail of the skb and panics.
Reject a block that does not fit before the skb is touched.
Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <[email protected]>
---
drivers/net/wireless/nxp/nxpwifi/util.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/nxp/nxpwifi/util.c b/drivers/net/wireless/nxp/nxpwifi/util.c
index 549661ca049a0..97811ee25f392 100644
--- a/drivers/net/wireless/nxp/nxpwifi/util.c
+++ b/drivers/net/wireless/nxp/nxpwifi/util.c
@@ -1228,6 +1228,12 @@ int nxpwifi_download_vdll_block(struct nxpwifi_adapter *adapter,
u16 msg_len = block_len + S_DS_GEN;
int ret = 0;
+ if (block_len > NXPWIFI_SIZE_OF_CMD_BUFFER - S_DS_GEN) {
+ nxpwifi_dbg(adapter, ERROR,
+ "VDLL block does not fit: len: %d\n", block_len);
+ return -EINVAL;
+ }
+
skb_trim(ctrl->skb, 0);
skb_put_zero(ctrl->skb, msg_len);
--
2.25.1