Received-SPF: pass (google.com: domain of linux-wireless+bounces-8069-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Precedence: bulk
MIME-Version: 1.0
From: James Dutton <james.dutton@gmail.com>
Date: Mon, 27 May 2024 00:43:48 +0100
Message-ID: <CAAMvbhGyheFdWSrDzM_i10n9s06n3G2wX6O_S68VUZyP-a9p+A@mail.gmail.com>
Subject: [PATCH] wifi: mac80211: add input validation to sta_stats_decode_rate()
To: linux-wireless@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"

Validation is required as a result of parameters derived from
received wifi packets.

Signed-off-by: James Courtier-Dutton <james.dutton@gmail.com>
---
 net/mac80211/sta_info.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index da5fdd6f5c85..bab05c6b1bcc 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -2437,11 +2437,26 @@ static void sta_stats_decode_rate(struct
ieee80211_local *local, u32 rate,
         int band = STA_STATS_GET(LEGACY_BAND, rate);
         int rate_idx = STA_STATS_GET(LEGACY_IDX, rate);

+        if (WARN_ON_ONCE(!local))
+            break;
+
+        if (WARN_ON_ONCE(!rinfo))
+            break;
+
+        if (WARN_ON_ONCE(band >= NUM_NL80211_BANDS))
+            break;
+
         sband = local->hw.wiphy->bands[band];

+        if (WARN_ON_ONCE(!sband))
+            break;
+
         if (WARN_ON_ONCE(!sband->bitrates))
             break;

+        if (WARN_ON_ONCE(rate_idx >= sband->n_bitrates))
+            break;
+
         brate = sband->bitrates[rate_idx].bitrate;
         if (rinfo->bw == RATE_INFO_BW_5)
             shift = 2;
-- 
2.43.0