Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 9 Jan 2020 13:12:35 +0100
From:   Salvatore Bonaccorso <carnil@debian.org>
To:     Ben Hutchings <ben@decadent.org.uk>
Cc:     linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
        huangwen <huangwenabc@gmail.com>,
        Ganapathi Bhat <gbhat@marvell.com>,
        Kalle Valo <kvalo@codeaurora.org>,
        Brian Norris <briannorris@chromium.org>
Subject: Re: [PATCH 3.16 62/63] mwifiex: fix possible heap overflow in
 mwifiex_process_country_ie()
Message-ID: <20200109121117.GB1270@lorien.valinor.li>
References: <lsq.1578512578.117275639@decadent.org.uk>
 <lsq.1578512578.718890478@decadent.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <lsq.1578512578.718890478@decadent.org.uk>
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Ben,

On Wed, Jan 08, 2020 at 07:44:00PM +0000, Ben Hutchings wrote:
> 3.16.81-rc1 review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Ganapathi Bhat <gbhat@marvell.com>
> 
> commit 3d94a4a8373bf5f45cf5f939e88b8354dbf2311b upstream.
> 
> mwifiex_process_country_ie() function parse elements of bss
> descriptor in beacon packet. When processing WLAN_EID_COUNTRY
> element, there is no upper limit check for country_ie_len before
> calling memcpy. The destination buffer domain_info->triplet is an
> array of length MWIFIEX_MAX_TRIPLET_802_11D(83). The remote
> attacker can build a fake AP with the same ssid as real AP, and
> send malicous beacon packet with long WLAN_EID_COUNTRY elemen
> (country_ie_len > 83). Attacker can  force STA connect to fake AP
> on a different channel. When the victim STA connects to fake AP,
> will trigger the heap buffer overflow. Fix this by checking for
> length and if found invalid, don not connect to the AP.
> 
> This fix addresses CVE-2019-14895.
> 
> Reported-by: huangwen <huangwenabc@gmail.com>
> Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
> [bwh: Backported to 3.16:
>  - Use wiphy_dbg() instead of mwifiex_dbg()
>  - Adjust filename]
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> ---
>  drivers/net/wireless/mwifiex/sta_ioctl.c | 13 +++++++++++--
>  1 file changed, 11 insertions(+), 2 deletions(-)
> 
> --- a/drivers/net/wireless/mwifiex/sta_ioctl.c
> +++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
> @@ -223,6 +223,14 @@ static int mwifiex_process_country_ie(st
>  			  "11D: skip setting domain info in FW\n");
>  		return 0;
>  	}
> +
> +	if (country_ie_len >
> +	    (IEEE80211_COUNTRY_STRING_LEN + MWIFIEX_MAX_TRIPLET_802_11D)) {
> +		wiphy_dbg(priv->wdev->wiphy,
> +			  "11D: country_ie_len overflow!, deauth AP\n");
> +		return -EINVAL;
> +	}
> +
>  	memcpy(priv->adapter->country_code, &country_ie[2], 2);
>  
>  	domain_info->country_code[0] = country_ie[2];
> @@ -266,8 +274,9 @@ int mwifiex_bss_start(struct mwifiex_pri
>  	priv->scan_block = false;
>  
>  	if (bss) {
> -		if (adapter->region_code == 0x00)
> -			mwifiex_process_country_ie(priv, bss);
> +		if (adapter->region_code == 0x00 &&
> +		    mwifiex_process_country_ie(priv, bss))
> +			return -EINVAL;
>  
>  		/* Allocate and fill new bss descriptor */
>  		bss_desc = kzalloc(sizeof(struct mwifiex_bssdescriptor),
> 

Brian Norris noted that this commit has unbalanced locking and
submitted a followup as per:

https://lkml.kernel.org/linux-wireless/20200106224212.189763-1-briannorris@chromium.org/T/#u
https://patchwork.kernel.org/patch/11320227/

Regards,
Salvatore