Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Sat, 9 Jan 2021 16:08:44 +0100
From:   Peter Seiderer <ps.report@gmx.net>
To:     Xiaohui Zhang <ruc_zhangxiaohui@163.com>
Cc:     Amitkumar Karwar <amitkarwar@gmail.com>,
        Ganapathi Bhat <ganapathi.bhat@nxp.com>,
        Xinming Hu <huxinming820@gmail.com>,
        Kalle Valo <kvalo@codeaurora.org>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>,
        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH 1/1] mwifiex: Fix possible buffer overflows in
 mwifiex_config_scan
Message-ID: <20210109160844.4ca73bf1@gmx.net>
In-Reply-To: <20201208124523.8169-1-ruc_zhangxiaohui@163.com>
References: <20201208124523.8169-1-ruc_zhangxiaohui@163.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hello Zhang,

On Tue,  8 Dec 2020 20:45:23 +0800, Xiaohui Zhang <ruc_zhangxiaohui@163.co=
m> wrote:

> From: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
>
> mwifiex_config_scan() calls memcpy() without checking
> the destination size may trigger a buffer overflower,
> which a local user could use to cause denial of service
> or the execution of arbitrary code.
> Fix it by putting the length check before calling memcpy().
>
> Signed-off-by: Zhang Xiaohui <ruc_zhangxiaohui@163.com>
> ---
>  drivers/net/wireless/marvell/mwifiex/scan.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/w=
ireless/marvell/mwifiex/scan.c
> index c2a685f63..b1d90678f 100644
> --- a/drivers/net/wireless/marvell/mwifiex/scan.c
> +++ b/drivers/net/wireless/marvell/mwifiex/scan.c
> @@ -930,6 +930,8 @@ mwifiex_config_scan(struct mwifiex_private *priv,
>  				    "DIRECT-", 7))
>  				wildcard_ssid_tlv->max_ssid_length =3D 0xfe;
>
> +			if (ssid_len > 1)
> +				ssid_len =3D 1;

Why do your believe the available size is only '1'? A SSID is expected
to be of size IEEE80211_MAX_SSID_LE/32 and the wildcard_ssid_tlv pointer
is casted from tlv_pos (some lines above) which is a pointer/index into
scan_cfg_out->tlv_buf...

And the define (line 44) indicates there should be enough space for a SSID=
:

  42 /* Memory needed to store a max number/size WildCard SSID TLV for a f=
irmware
  43         scan */
  44 #define WILDCARD_SSID_TLV_MAX_SIZE  \
  45         (MWIFIEX_MAX_SSID_LIST_LENGTH *                              =
   \
  46                 (sizeof(struct mwifiex_ie_types_wildcard_ssid_params)=
   \
  47                         + IEEE80211_MAX_SSID_LEN))

For sure something to improve here instead of using a confusing 'u8 ssid[1=
]'
in struct mwifiex_ie_types_wildcard_ssid_params...

Regards,
Peter

>  			memcpy(wildcard_ssid_tlv->ssid,
>  			       user_scan_in->ssid_list[i].ssid, ssid_len);
>