Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Anant Thazhemadam <anant.thazhemadam@gmail.com>
To:     Johannes Berg <johannes@sipsolutions.net>,
        "David S. Miller" <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>
Cc:     Anant Thazhemadam <anant.thazhemadam@gmail.com>,
        linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com
Subject: [PATCH] net: mac80211: cfg: enforce sanity checks for key_index in ieee80211_del_key()
Date:   Tue,  1 Dec 2020 15:26:39 +0530
Message-Id: <20201201095639.63936-1-anant.thazhemadam@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Currently, it is assumed that key_idx values that are passed to
ieee80211_del_key() are all valid indexes as is, and no sanity checks
are performed for it.
However, syzbot was able to trigger an array-index-out-of-bounds bug
by passing a key_idx value of 5, when the maximum permissible index
value is (NUM_DEFAULT_KEYS - 1).
Enforcing sanity checks helps in preventing this bug, or a similar
instance in the context of ieee80211_del_key() from occurring.

Reported-by: syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com
Tested-by: syzbot+49d4cab497c2142ee170@syzkaller.appspotmail.com
Signed-off-by: Anant Thazhemadam <anant.thazhemadam@gmail.com>
---
 net/mac80211/cfg.c | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7276e66ae435..d349e33134e6 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -516,12 +516,30 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
 		if (!sta)
 			goto out_unlock;
 
-		if (pairwise)
+		if (pairwise) {
+			if (key_idx >= NUM_DEFAULT_KEYS) {
+				ret = -EINVAL;
+				goto out_unlock;
+			}
 			key = key_mtx_dereference(local, sta->ptk[key_idx]);
-		else
+		} else {
+			if (key_idx >= (NUM_DEFAULT_KEYS +
+					NUM_DEFAULT_MGMT_KEYS +
+					NUM_DEFAULT_BEACON_KEYS)) {
+				ret = -EINVAL;
+				goto out_unlock;
+			}
 			key = key_mtx_dereference(local, sta->gtk[key_idx]);
-	} else
+		}
+	} else {
+		if (key_idx >= (NUM_DEFAULT_KEYS +
+				NUM_DEFAULT_MGMT_KEYS +
+				NUM_DEFAULT_BEACON_KEYS)) {
+			ret = -EINVAL;
+			goto out_unlock;
+		}
 		key = key_mtx_dereference(local, sdata->keys[key_idx]);
+	}
 
 	if (!key) {
 		ret = -ENOENT;
-- 
2.25.1