Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   =?ISO-8859-1?Q?J=E9r=F4me?= Pouiller <jerome.pouiller@silabs.com>
To:     Dan Carpenter <dan.carpenter@oracle.com>
Cc:     Kalle Valo <kvalo@kernel.org>, linux-wireless@vger.kernel.org,
        kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] wfx: prevent underflow in wfx_send_pds()
Date:   Mon, 22 Aug 2022 14:20:53 +0200
Message-ID: <2729343.a3EqFhE7eK@pc-42>
Organization: Silicon Labs
In-Reply-To: <Yv8eX7Xv2ubUOvW7@kili>
References: <Yv8eX7Xv2ubUOvW7@kili>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?iso-8859-1?Q?kAppOl9Frhu+QHWNnY5EHWSamY1Tw2PQU9i7CfUuoYki3H/TtBxIwmQf77?=
 =?iso-8859-1?Q?1wgflP2NiA4TKyGtZUKrjX0p8LOwPElexjHMXpwGVhBA/w3ESMw8NLZe9y?=
 =?iso-8859-1?Q?DkyBsE3g4cM8nsceOqoIMk0pvFOTUWJjIlpdmSgJhgrNLZ+F75oW2PdwiL?=
 =?iso-8859-1?Q?mn1OZ5ubekIiH0fx+usF3GsJmV0C0dbo1OYclJv1IYftezGbCU0xzow4TJ?=
 =?iso-8859-1?Q?IyU2clud9K+NFlMmhHoGvLzkPU1ds0s6MQQvuFzTRKWIj2l4q4ozkp6zwD?=
 =?iso-8859-1?Q?GbdLBkY9YX44kdynpb9Awfuwj+2siSBUYWtdXMdkpjXBZZyH1X9kXSpYa3?=
 =?iso-8859-1?Q?tbtVv7zm5uMJDRw41PwNXB0zVCtouhc78KM4hoH5FeDnBZcrA6rwOqRuTn?=
 =?iso-8859-1?Q?8477SvTHn9ezObYBKJFroPzjLa9VcJkJ9ggKVdai11yshDLI+3qnsENtNk?=
 =?iso-8859-1?Q?tCPdayRDKRUB2GQMIBKY9h4ZWE1+lIVIX3DLutxhZ4iowLNi8VJoVGevas?=
 =?iso-8859-1?Q?qXkCGQ/TWr0oykLVdM7HdmhdhMFbfrV4YpvS8TRLODJe6VamlWAebZLaDF?=
 =?iso-8859-1?Q?uPIsUX7ipaARH80tfekdOc4Myz1a6Q+QrPKBiTWV6XIf1hhA6Qy/27k+0H?=
 =?iso-8859-1?Q?LSOGFm24tt1CBE7a0ctEGVXJ873WW9nyq7ScWP+Ucs1mT6lxxPwMDzZL6B?=
 =?iso-8859-1?Q?Xg/cpQMhShVwZZQZQS+O+WIrhAhEJ0Q/MU6X4nLNqAIanTzPFVrj29fMlC?=
 =?iso-8859-1?Q?6hDAomE7/LdSLSr/1CX+ZiYUEwV+jrF9FmoRXQ3k4qMjnOgKhgGj+VM5x9?=
 =?iso-8859-1?Q?ycRrwDwzmq0HniY++UY/e8h/05B7J119mYhMPPq6md8/RlicDgrjxbcMsM?=
 =?iso-8859-1?Q?WgHwDegovJ8EvTOM/r9gvkSGUsEYgwXhEFmEKkDblEZ4ve77j0awLJpFK+?=
 =?iso-8859-1?Q?sdpcmLIrh/Hqe7m0iUid7S0Y6ZKMIR+Pgjdnopb5CzFBRjVmmHU0bM77RH?=
 =?iso-8859-1?Q?QKEboQZue3M8z4KrUfrKCUrvwuJjTkOOkGbopzCYht1asUX/W3wtI0Iy3F?=
 =?iso-8859-1?Q?bDYnytWnZRnGS+qU2odhQAxQooyvZzIvAVmBl8ZpLCiScyORlse4KQGQoV?=
 =?iso-8859-1?Q?qnDqbMYJdxPTYPtLCNRBRA9GDmiT0sIq1QTXd9oJAzs3orizqLkbmE7N+p?=
 =?iso-8859-1?Q?RbA9TqOUNwfLynMHNkuDPJPQfGmhnChzrEgunUJKk/kEuf6NioKesuizuJ?=
 =?iso-8859-1?Q?dcRfT62bLh2wSpLULP/RtaUxnD6Kr0hFQMT8cO2l0c5UuL8Xkc78b82TNW?=
 =?iso-8859-1?Q?CVVEZtOEak4RqtxyHRw7pUMjY/9xJpjqCiqo4xz1WqQ3vYovG84Tc8VsAW?=
 =?iso-8859-1?Q?DzL9VK6/mIcsfbqzOdEpxVrLdhbUWf1AAAM61kGv+fM2HjYeulnVe4b1XB?=
 =?iso-8859-1?Q?fwqw4lXK9tmEU5wh0gpf03/3hNDc8Se2iOcMC86iuZN2HfJW1hTfj+ZYiq?=
 =?iso-8859-1?Q?G1UzKxFn8PTqbHz2BOd2FablPuowS8CVPFcw+H6g0Wza6ypAT8weSpqm58?=
 =?iso-8859-1?Q?fG5ndQLW49AG0c6JiFMHoVXcGT8CY9lL7qxFOBqU5irjdRGjq1mp4jhkeF?=
 =?iso-8859-1?Q?4zTw3nNq2xAzjI6dfY8Nphyo1YlC+Yxk8dtw9SIte0MxQZSREx//4eh04L?=
 =?iso-8859-1?Q?XgYoXgWBOlmAgoprOW7hfYh2B+JVyUArrWs9JIwL?=
X-OriginatorOrg: silabs.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6b677611-49c2-47b0-ade8-08da8438c3ee
X-MS-Exchange-CrossTenant-AuthSource: DS7PR11MB6038.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Aug 2022 12:20:56.7829
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 54dbd822-5231-4b20-944d-6f4abcd541fb
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: oxz8ke2FwChf5D+eFVJl8lltv+CGF9KQSRWqarwzqZIBeNKtPJ14tv2GQVhRx7im0FOzOTAv7Q/3UenoNhtwyw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR11MB3938
X-Spam-Status: No, score=-0.9 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,FORGED_SPF_HELO,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,
        SPF_HELO_PASS,SPF_NONE,T_SCC_BODY_TEXT_LINE autolearn=no
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

On Friday 19 August 2022 07:23:43 CEST Dan Carpenter wrote:
> This does a "chunk_len - 4" subtraction later when it calls:
>=20
>         ret =3D wfx_hif_configuration(wdev, buf + 4, chunk_len - 4);
>=20
> so check for "chunk_len" is less than 4.

This patch also ensures that buf[4] won't overflow during:

    if (buf[4] !=3D '{' || buf[chunk_len - 1] !=3D '}')
    	dev_warn(wdev->dev, "PDS:%d: unexpected content\n", chunk_num);

> Fixes: dcbecb497908 ("staging: wfx: allow new PDS format")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

Reviewed-by: J=E9r=F4me Pouiller <jerome.pouiller@silabs.com>

--=20
J=E9r=F4me Pouiller