Commit 69ae4f6a authored by Takashi Iwai's avatar Takashi Iwai Committed by Kalle Valo

mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies()

A few places in mwifiex_uap_parse_tail_ies() perform memcpy()
unconditionally, which may lead to either buffer overflow or read over
boundary.

This patch addresses the issues by checking the read size and the
destination size at each place more properly.  Along with the fixes,
the patch cleans up the code slightly by introducing a temporary
variable for the token size, and unifies the error path with the
standard goto statement.
Reported-by: default avatarhuangwen <huangwen@venustech.com.cn>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 5f4d55d5
...@@ -329,6 +329,8 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, ...@@ -329,6 +329,8 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
struct ieee80211_vendor_ie *vendorhdr; struct ieee80211_vendor_ie *vendorhdr;
u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0; u16 gen_idx = MWIFIEX_AUTO_IDX_MASK, ie_len = 0;
int left_len, parsed_len = 0; int left_len, parsed_len = 0;
unsigned int token_len;
int err = 0;
if (!info->tail || !info->tail_len) if (!info->tail || !info->tail_len)
return 0; return 0;
...@@ -344,6 +346,12 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, ...@@ -344,6 +346,12 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
*/ */
while (left_len > sizeof(struct ieee_types_header)) { while (left_len > sizeof(struct ieee_types_header)) {
hdr = (void *)(info->tail + parsed_len); hdr = (void *)(info->tail + parsed_len);
token_len = hdr->len + sizeof(struct ieee_types_header);
if (token_len > left_len) {
err = -EINVAL;
goto out;
}
switch (hdr->element_id) { switch (hdr->element_id) {
case WLAN_EID_SSID: case WLAN_EID_SSID:
case WLAN_EID_SUPP_RATES: case WLAN_EID_SUPP_RATES:
...@@ -361,17 +369,20 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, ...@@ -361,17 +369,20 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
if (cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT, if (cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
WLAN_OUI_TYPE_MICROSOFT_WMM, WLAN_OUI_TYPE_MICROSOFT_WMM,
(const u8 *)hdr, (const u8 *)hdr,
hdr->len + sizeof(struct ieee_types_header))) token_len))
break; break;
/* fall through */ /* fall through */
default: default:
memcpy(gen_ie->ie_buffer + ie_len, hdr, if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
hdr->len + sizeof(struct ieee_types_header)); err = -EINVAL;
ie_len += hdr->len + sizeof(struct ieee_types_header); goto out;
}
memcpy(gen_ie->ie_buffer + ie_len, hdr, token_len);
ie_len += token_len;
break; break;
} }
left_len -= hdr->len + sizeof(struct ieee_types_header); left_len -= token_len;
parsed_len += hdr->len + sizeof(struct ieee_types_header); parsed_len += token_len;
} }
/* parse only WPA vendor IE from tail, WMM IE is configured by /* parse only WPA vendor IE from tail, WMM IE is configured by
...@@ -381,15 +392,17 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, ...@@ -381,15 +392,17 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
WLAN_OUI_TYPE_MICROSOFT_WPA, WLAN_OUI_TYPE_MICROSOFT_WPA,
info->tail, info->tail_len); info->tail, info->tail_len);
if (vendorhdr) { if (vendorhdr) {
memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, token_len = vendorhdr->len + sizeof(struct ieee_types_header);
vendorhdr->len + sizeof(struct ieee_types_header)); if (ie_len + token_len > IEEE_MAX_IE_SIZE) {
ie_len += vendorhdr->len + sizeof(struct ieee_types_header); err = -EINVAL;
goto out;
}
memcpy(gen_ie->ie_buffer + ie_len, vendorhdr, token_len);
ie_len += token_len;
} }
if (!ie_len) { if (!ie_len)
kfree(gen_ie); goto out;
return 0;
}
gen_ie->ie_index = cpu_to_le16(gen_idx); gen_ie->ie_index = cpu_to_le16(gen_idx);
gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON | gen_ie->mgmt_subtype_mask = cpu_to_le16(MGMT_MASK_BEACON |
...@@ -399,13 +412,15 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv, ...@@ -399,13 +412,15 @@ static int mwifiex_uap_parse_tail_ies(struct mwifiex_private *priv,
if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL, NULL, if (mwifiex_update_uap_custom_ie(priv, gen_ie, &gen_idx, NULL, NULL,
NULL, NULL)) { NULL, NULL)) {
kfree(gen_ie); err = -EINVAL;
return -1; goto out;
} }
priv->gen_idx = gen_idx; priv->gen_idx = gen_idx;
out:
kfree(gen_ie); kfree(gen_ie);
return 0; return err;
} }
/* This function parses different IEs-head & tail IEs, beacon IEs, /* This function parses different IEs-head & tail IEs, beacon IEs,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment