wifi: mwifiex: Fix tlv_buf_left calculation and replace one-element array

In a TLV encoding scheme, the Length part represents the length after the header containing the values for type and length. In this case, tlv_len should be:

tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len

Notice that the - 1 accounts for the one-element array bitmap, which 1-byte size is already included in sizeof(*tlv_rxba).

So, if the above is correct, there is a double-counting of some members in struct mwifiex_ie_types_rxba_sync, when tlv_buf_left and tmp are calculated:

968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);

in specific, members:

drivers/net/wireless/marvell/mwifiex/fw.h:777

 777         u8 mac[ETH_ALEN];
 778         u8 tid;
 779         u8 reserved;
 780         __le16 seq_num;
 781         __le16 bitmap_len;

This is clearly wrong, and affects the subsequent decoding of data in event_buf through tlv_rxba:

970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;

Fix this by using sizeof(tlv_rxba->header) instead of sizeof(*tlv_rxba) in the calculation of tlv_buf_left and tmp.

This results in the following binary differences before/after changes:

| drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
| @@ -4698,11 +4698,11 @@
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
|                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
| -    1da7:      lea    -0x11(%rbx),%edx
| +    1da7:      lea    -0x4(%rbx),%edx
|      1daa:      movzwl %bp,%eax
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
|                 tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
| -    1dad:      lea    0x11(%r15,%rbp,1),%r15
| +    1dad:      lea    0x4(%r15,%rbp,1),%r15

The above reflects the desired change: avoid counting 13 too many bytes; which is the total size of the double-counted members in struct mwifiex_ie_types_rxba_sync:

$ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
struct mwifiex_ie_types_rxba_sync {
	struct mwifiex_ie_types_header header;           /*     0     4 */

     |-----------------------------------------------------------------------
     |  u8                         mac[6];               /*     4     6 */  |
     |	u8                         tid;                  /*    10     1 */  |
     |  u8                         reserved;             /*    11     1 */  |
     | 	__le16                     seq_num;              /*    12     2 */  |
     | 	__le16                     bitmap_len;           /*    14     2 */  |
     |  u8                         bitmap[1];            /*    16     1 */  |
     |----------------------------------------------------------------------|
								  | 13 bytes|
								  -----------

	/* size: 17, cachelines: 1, members: 7 */
	/* last cacheline: 17 bytes */
} __attribute__((__packed__));

Fixes 99ffe72cdae4 ("mwifiex: process rxba_sync event")

Cc [email protected]

Signed-off-by Gustavo A. R. Silva <[email protected]>

In a TLV encoding scheme, the Length part represents the length after the header containing the values for type and length. In this case, tlv_len should be:

tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len

Notice that the - 1 accounts for the one-element array bitmap, which 1-byte size is already included in sizeof(*tlv_rxba).

So, if the above is correct, there is a double-counting of some members in struct mwifiex_ie_types_rxba_sync, when tlv_buf_left and tmp are calculated:

968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);

in specific, members:

drivers/net/wireless/marvell/mwifiex/fw.h:777

 777         u8 mac[ETH_ALEN];
 778         u8 tid;
 779         u8 reserved;
 780         __le16 seq_num;
 781         __le16 bitmap_len;

This is clearly wrong, and affects the subsequent decoding of data in event_buf through tlv_rxba:

970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;

Fix this by using sizeof(tlv_rxba->header) instead of sizeof(*tlv_rxba) in the calculation of tlv_buf_left and tmp.

This results in the following binary differences before/after changes:

| drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
| @@ -4698,11 +4698,11 @@
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
|                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
| -    1da7:      lea    -0x11(%rbx),%edx
| +    1da7:      lea    -0x4(%rbx),%edx
|      1daa:      movzwl %bp,%eax
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
|                 tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
| -    1dad:      lea    0x11(%r15,%rbp,1),%r15
| +    1dad:      lea    0x4(%r15,%rbp,1),%r15

The above reflects the desired change: avoid counting 13 too many bytes; which is the total size of the double-counted members in struct mwifiex_ie_types_rxba_sync:

$ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
struct mwifiex_ie_types_rxba_sync {
	struct mwifiex_ie_types_header header;           /*     0     4 */

     |-----------------------------------------------------------------------
     |  u8                         mac[6];               /*     4     6 */  |
     |	u8                         tid;                  /*    10     1 */  |
     |  u8                         reserved;             /*    11     1 */  |
     | 	__le16                     seq_num;              /*    12     2 */  |
     | 	__le16                     bitmap_len;           /*    14     2 */  |
     |  u8                         bitmap[1];            /*    16     1 */  |
     |----------------------------------------------------------------------|
								  | 13 bytes|
								  -----------

	/* size: 17, cachelines: 1, members: 7 */
	/* last cacheline: 17 bytes */
} __attribute__((__packed__));

Fixes 99ffe72cdae4 ("mwifiex: process rxba_sync event")

Cc [email protected]

Signed-off-by Gustavo A. R. Silva <[email protected]>

Reviewed-by Kees Cook <[email protected]>

3 patches applied to wireless.git, thanks.

eec679e4ac5f wifi: mwifiex: Fix tlv_buf_left calculation
c7847241de28 wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync d5a93b7d2877 wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len

One-element and zero-length arrays are deprecated. So, replace one-element array in struct mwifiex_ie_types_rxba_sync with flexible-array member, and refactor the rest of the code, accordingly.

This results in no differences in binary output.

Signed-off-by Gustavo A. R. Silva <[email protected]>

Add sanity checks for both tlv_len and tlv_bitmap_len before decoding data from event_buf.

This prevents any malicious or buggy firmware from overflowing event_buf through large values for tlv_len and tlv_bitmap_len.

Suggested-by Dan Williams <[email protected]>

Signed-off-by Gustavo A. R. Silva <[email protected]>

---
Changes in v2:
- Fix format specifier: %ld -> %zu
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

- Update warning messages to explicitly mention that TLV size is greater than tlv_buf_len.

v1:
- Link: https://lore.kernel.org/linux-hardening/587423b0737108effe82aefed4407daca39e9a51.1692829410.git.gustavoars@kernel.org/

 .../net/wireless/marvell/mwifiex/11n_rxreorder.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c +0 -0

index 735aac52bdc4..10690e82358b 100644

drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c +11 -0

+			return;
+		}
+
 		if (tlv_type != TLV_TYPE_RXBA_SYNC) {
 			mwifiex_dbg(priv->adapter, ERROR,
 				    "Wrong TLV id=0x%x\n", tlv_type);

@@ -929,6 +937,14 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
 
 		tlv_seq_num = le16_to_cpu(tlv_rxba->seq_num);
 		tlv_bitmap_len = le16_to_cpu(tlv_rxba->bitmap_len);
+		if (size_add(sizeof(*tlv_rxba), tlv_bitmap_len) > tlv_buf_left) {
+			mwifiex_dbg(priv->adapter, WARN,
+				    "TLV size (%zu) overflows event_buf buf_left=%d\n",
+				    size_add(sizeof(*tlv_rxba), tlv_bitmap_len),
+				    tlv_buf_left);
+			return;
+		}
+
 		mwifiex_dbg(priv->adapter, INFO,
 			    "%pM tid=%d seq_num=%d bitmap_len=%d\n",
 			    tlv_rxba->mac, tlv_rxba->tid, tlv_seq_num,

Signature · 1 line

2.34.1

drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv, · line 928

Quoted 4 lines · Gustavo A. R. Silva

drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c +4 -0

+                     mwifiex_dbg(priv->adapter, WARN,
+                                 "TLV size (%zu) overflows event_buf buf_left=%d\n",
+                                 size_add(sizeof(tlv_rxba->header), tlv_len),
+                                 tlv_buf_left);

With the suggested change to make this a warning and not dbg:

Quoted 6 lines · Kees Cook

Quoted 4 lines · Gustavo A. R. Silva

drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c +4 -0

+                     mwifiex_dbg(priv->adapter, WARN,
+                                 "TLV size (%zu) overflows event_buf buf_left=%d\n",
+                                 size_add(sizeof(tlv_rxba->header), tlv_len),
+                                 tlv_buf_left);

Quoted 1 line

With the suggested change to make this a warning and not dbg:

mwifiex_dbg(..., WARN, ...) *is* a warning, not a debug message. Or at least, that's how it's used throughout this driver, even though it actually yields a dev_info()-level message, regardless of the 'mask' arg: