From patchwork Fri Jul 7 20:09:06 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Arend van Spriel X-Patchwork-Id: 9831109 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7A6B460317 for ; Fri, 7 Jul 2017 20:09:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6BFB3283BB for ; Fri, 7 Jul 2017 20:09:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 5F453284FC; Fri, 7 Jul 2017 20:09:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C967F283BB for ; Fri, 7 Jul 2017 20:09:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752620AbdGGUJ2 (ORCPT ); Fri, 7 Jul 2017 16:09:28 -0400 Received: from lpdvrndsmtp01.broadcom.com ([192.19.229.170]:47270 "EHLO rnd-relay.smtp.broadcom.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751100AbdGGUJ1 (ORCPT ); Fri, 7 Jul 2017 16:09:27 -0400 Received: from mail-irv-17.broadcom.com (mail-irv-17.lvn.broadcom.net [10.75.224.233]) by rnd-relay.smtp.broadcom.com (Postfix) with ESMTP id 942CF30C005; Fri, 7 Jul 2017 13:09:26 -0700 (PDT) Received: from jenkins-cam-14.cam.broadcom.com (jenkins-cam-14.cam.broadcom.com [10.177.128.77]) by mail-irv-17.broadcom.com (Postfix) with ESMTP id 2E2CA81EA4; Fri, 7 Jul 2017 13:09:26 -0700 (PDT) Received: by jenkins-cam-14.cam.broadcom.com (Postfix, from userid 25152) id 4D3F8B8504A; Fri, 7 Jul 2017 21:09:25 +0100 (BST) From: Arend van Spriel To: David Miller Cc: netdev@vger.kernel.org, linux-wireless@vger.kernel.org, Linus Torvalds , Arend van Spriel Subject: [PATCH V2] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() Date: Fri, 7 Jul 2017 21:09:06 +0100 Message-Id: <1499458154-18358-1-git-send-email-arend.vanspriel@broadcom.com> X-Mailer: git-send-email 1.9.1 MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The lower level nl80211 code in cfg80211 ensures that "len" is between 25 and NL80211_ATTR_FRAME (2304). We subtract DOT11_MGMT_HDR_LEN (24) from "len" so thats's max of 2280. However, the action_frame->data[] buffer is only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy() can overflow. memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN], le16_to_cpu(action_frame->len)); Cc: stable@vger.kernel.org # 3.9.x Fixes: 18e2f61db3b70 ("brcmfmac: P2P action frame tx.") Reported-by: "freenerguo(郭大兴)" Signed-off-by: Arend van Spriel --- V2: - added Fixes: tag and Cc: for stable kernels. - Cc: patch to netdev list. --- Hi David, Here is the patch as Linus send it to us and security@kernel.org. I removed the lower bound check as that is already done in cfg80211. Now I signed off on the patch although formally I suppose Linus should sign it off. Putting it out there so people can respond as deemed necessary. The reason for submitting it to your tree is the fact that Kalle is on vacation for next 10 days or so which was indicated to me by Johannes. The patch applies to the master branch of your net repository. For reference V1 of this patch can be found here [1]. Regards, Arend [1] https://patchwork.kernel.org/patch/9829977/ --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index cd1d673..d182a00 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -4851,6 +4851,11 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev) cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true, GFP_KERNEL); } else if (ieee80211_is_action(mgmt->frame_control)) { + if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) { + brcmf_err("invalid action frame length\n"); + err = -EINVAL; + goto exit; + } af_params = kzalloc(sizeof(*af_params), GFP_KERNEL); if (af_params == NULL) { brcmf_err("unable to allocate frame\n");