Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751726AbdG0Jg0 (ORCPT ); Thu, 27 Jul 2017 05:36:26 -0400 Received: from smtp.codeaurora.org ([198.145.29.96]:41184 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750836AbdG0JgY (ORCPT ); Thu, 27 Jul 2017 05:36:24 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org EB0F3607BC Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=kvalo@codeaurora.org Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: Re: mwifiex: correct channel stat buffer overflows From: Kalle Valo In-Reply-To: <20170630012354.98931-1-briannorris@chromium.org> References: <20170630012354.98931-1-briannorris@chromium.org> To: Brian Norris Cc: Ganapathi Bhat , Nishant Sarmukadam , , Dmitry Torokhov , Amitkumar Karwar , linux-wireless@vger.kernel.org, Brian Norris , stable@vger.kernel.org, Avinash Patil , Xinming Hu User-Agent: pwcli/0.0.0-git (https://github.com/kvalo/pwcli/) Python/2.7.12 Message-Id: <20170727093624.061F96095E@smtp.codeaurora.org> Date: Thu, 27 Jul 2017 09:36:24 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1895 Lines: 43 Brian Norris wrote: > mwifiex records information about various channels as it receives scan > information. It does this by appending to a buffer that was sized > to the max number of supported channels on any band, but there are > numerous problems: > > (a) scans can return info from more than one band (e.g., both 2.4 and 5 > GHz), so the determined "max" is not large enough > (b) some firmware appears to return multiple results for a given > channel, so the max *really* isn't large enough > (c) there is no bounds checking when stashing these stats, so problems > (a) and (b) can easily lead to buffer overflows > > Let's patch this by setting a slightly-more-correct max (that accounts > for a combination of both 2.4G and 5G bands) and adding a bounds check > when writing to our statistics buffer. > > Due to problem (b), we still might not properly report all known survey > information (e.g., with "iw survey dump"), since duplicate results > (or otherwise "larger than expected" results) will cause some > truncation. But that's a problem for a future bugfix. > > (And because of this known deficiency, only log the excess at the WARN > level, since that isn't visible by default in this driver and would > otherwise be a bit too noisy.) > > Fixes: bf35443314ac ("mwifiex: channel statistics support for mwifiex") > Cc: > Cc: Avinash Patil > Cc: Xinming Hu > Signed-off-by: Brian Norris > Reviewed-by: Dmitry Torokhov > Reviewed-by: Ganapathi Bhat Patch applied to wireless-drivers-next.git, thanks. 4b5dde2d6234 mwifiex: correct channel stat buffer overflows -- https://patchwork.kernel.org/patch/9818269/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches