wifi: mwifiex: firmware response validation fixes
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest3 patches 0 repliesNew
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/3 | wifi: mwifiex: validate TID in ADDBA response handlerdrivers/ | +6 | 0 replies | |
| 2/3 | wifi: mwifiex: validate intf_num in multichannel event handlerdrivers/ | +4 | 0 replies | |
| 3/3 | wifi: mwifiex: cap TLV length in IBSS connected event handlerdrivers/ | +2 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH wireless 0/3] wifi: mwifiex: firmware response validation fixes
From: Tristan Madani <[email protected]>
Three input validation fixes for the mwifiex driver:
1/3: The ADDBA response handler uses a 4-bit TID value (0-15) to
index an 8-entry array. Values >= 8 result in out-of-bounds array access.
2/3: The multichannel event handler uses intf_num from a TLV to
iterate a flexible array without checking it fits the TLV data.
3/3: The IBSS connected event handler replaces a buffer-bounded
length with the TLV header length, which may exceed the event buffer.
Tristan Madani (3):
wifi: mwifiex: validate TID in ADDBA response handler
wifi: mwifiex: validate intf_num in multichannel event handler
wifi: mwifiex: cap TLV length in IBSS connected event handler
drivers/net/wireless/marvell/mwifiex/11n.c | 6 ++++++ drivers/net/wireless/marvell/mwifiex/sta_event.c | 6 ++++++ 2 files changed, 12 insertions(+)
Signature · 1 line
2.47.3