mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-28 06:23:42 -04:00
Code Issues Packages Projects Releases Wiki Activity

wifi: nxpwifi: bound uAP association event IEs to the event buffer

Browse Source 
nxpwifi_uap_event_sta_assoc() exposes the association request IEs that
the firmware reports in the uAP association event, which the driver
copies into the fixed-size event_body[] buffer.

event->len is supplied by firmware and is not validated. A value smaller
than the header underflows the subtraction used for assoc_req_ies_len,
while a larger value can make the IE range extend beyond event_body[].
Subsequent IE parsing can then read past the adapter object.

Validate both bounds before using the firmware-reported length.

nxpwifi was derived from mwifiex before commit f0858bfc7d ("wifi:
mwifiex: bound uAP association event IEs to the event buffer") and
retains the same unchecked length. Apply the equivalent bounds check
here.

Fixes: 73b01e57ed ("wifi: nxp: add nxpwifi driver for IW61x")
Signed-off-by: Linmao Li <lilinmao@kylinos.cn>
Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com>
Link: https://patch.msgid.link/20260729082457.1897303-1-lilinmao@kylinos.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Linmao Li
2026-07-29 16:24:57 +08:00
committed by Johannes Berg
parent 068986fd6f
commit ca800a9302
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/net/wireless/nxp/nxpwifi/uap_event.c
View File

@@ -107,11 +107,29 @@ nxpwifi_uap_event_sta_assoc(struct nxpwifi_private *priv)
len = ETH_ALEN;
if (len != -1) {
u16 evt_len = le16_to_cpu(event->len);
sinfo->assoc_req_ies = &event->data[len];
len = (u8 *)sinfo->assoc_req_ies -
(u8 *)&event->frame_control;
sinfo->assoc_req_ies_len =
le16_to_cpu(event->len) - (u16)len;
/*
* event->len is reported by the device firmware
* and is not otherwise validated. Reject a length
* that underflows the header or that would place
* the association request IEs outside the fixed
* event_body[] buffer.
*/
if (evt_len < len ||
(u8 *)&event->frame_control + evt_len >
adapter->event_body + MAX_EVENT_SIZE) {
nxpwifi_dbg(adapter, ERROR,
"invalid STA assoc event length\n");
kfree(sinfo);
return -EINVAL;
}
sinfo->assoc_req_ies_len = evt_len - (u16)len;
}
}
cfg80211_new_sta(priv->netdev->ieee80211_ptr, event->sta_addr, sinfo,