Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <e3e67383-6f34-825b-8a2c-1c6decc44576@gmail.com>
Date:   Thu, 20 Oct 2022 10:41:34 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.13.1
Subject: Re: [PATCH] brcmfmac: Fixes potential buffer overflow in
 'brcmf_fweh_event_worker'
Content-Language: en-US
From:   Arend Van Spriel <aspriel@gmail.com>
To:     Dokyung Song <dokyung.song@gmail.com>,
        linux-wireless@vger.kernel.org
Cc:     Jisoo Jang <jisoo.jang@yonsei.ac.kr>,
        Minsuk Kang <linuxlovemin@yonsei.ac.kr>
References: <20221020014907.GA338234@laguna>
 <649de84e-6f9a-5c6b-9a94-a7c6462abd1f@gmail.com>
In-Reply-To: <649de84e-6f9a-5c6b-9a94-a7c6462abd1f@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

On 10/20/2022 10:39 AM, Arend Van Spriel wrote:
>> -        else
>> +        } else {
>> +            if (emsg.bsscfgidx >= BRCMF_MAX_IFS) {
>> +                bphy_err(drvr, "invalid bsscfg index: %u\n", 
>> emsg.bsscfgidx);
>> +                goto event_free;
>> +            }
> 
> probably better to do the validation before any other handling. So right 
> after converting the event message at line 245
> 
> https://elixir.bootlin.com/linux/latest/source/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c#L245 

Actually, if we ignore the event message we can avoid the whole 
conversion as well doing the validation before the convert.

Regards,
Arend