Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <10230673-8dbe-bf67-ba76-9f8cdc35faf3@gmail.com>
Date:   Fri, 21 Oct 2022 10:38:20 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.13.1
Subject: Re: [PATCH v3] wifi: Fix potential buffer overflow in
 'brcmf_fweh_event_worker'
Content-Language: en-US
To:     Kalle Valo <kvalo@kernel.org>,
        Dokyung Song <dokyung.song@gmail.com>
Cc:     linux-wireless@vger.kernel.org,
        Jisoo Jang <jisoo.jang@yonsei.ac.kr>,
        Minsuk Kang <linuxlovemin@yonsei.ac.kr>
References: <20221021061359.GA550858@laguna> <87v8od1x69.fsf@kernel.org>
From:   Arend Van Spriel <aspriel@gmail.com>
In-Reply-To: <87v8od1x69.fsf@kernel.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 10/21/2022 8:57 AM, Kalle Valo wrote:
> Dokyung Song <dokyung.song@gmail.com> writes:
> 
>> This patch fixes an intra-object buffer overflow in brcmfmac that occurs
>> when the device provides a 'bsscfgidx' equal to or greater than the
>> buffer size. The patch adds a check that leads to a safe failure if that
>> is the case.
>>
>> This fixes CVE-2022-3628.
>>
>> UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
>> index 52 is out of range for type 'brcmf_if *[16]'

[...]

>> Reported-by: Dokyung Song <dokyungs@yonsei.ac.kr>
>> Reported-by: Jisoo Jang <jisoo.jang@yonsei.ac.kr>
>> Reported-by: Minsuk Kang <linuxlovemin@yonsei.ac.kr>
>> Reviewed-by: Arend van Spriel <aspriel@gmail.com>
>> Signed-off-by: Dokyung Song <dokyung.song@gmail.com>
>> ---
>> v1->v2: Addressed review comments
>> v2->v3: The subject now begins with 'wifi:' and add a reference to a CVE number
>>
>>   drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 4 ++++
>>   1 file changed, 4 insertions(+)
> 
> Please include the driver name in the subject. And we prefer use
> parenthesis with function names. So the subject should be:
> 
> wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker()
> 
> I can fix that during commit.
> 
> Should I queue this to v6.1?

Please do. Probably good to add Cc: for stable. Should apply to older 
kernels as is.

btw. is there any formal way to reference CVE. There probably isn't as 
generally we don't require a CVE in kernel tree [1].

Regards,
Arend

[1] https://docs.kernel.org/admin-guide/security-bugs.html