Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17df6453 authored by Arend Van Spriel's avatar Arend Van Spriel Committed by Kalle Valo
Browse files

brcmfmac: add length check in brcmf_cfg80211_escan_handler() 



Upon handling the firmware notification for scans the length was
checked properly and may result in corrupting kernel heap memory
due to buffer overruns. This fix addresses CVE-2017-0786.

Cc: stable@vger.kernel.org # v4.0.x
Cc: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: default avatarHante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: default avatarPieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: default avatarFranky Lin <franky.lin@broadcom.com>
Signed-off-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 4c707c04

drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

+15 −3
Original line number Diff line number Diff line
@@ -3162,6 +3162,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, 
	struct brcmf_cfg80211_info *cfg = ifp->drvr->config;

	s32 status;

	struct brcmf_escan_result_le *escan_result_le;

	u32 escan_buflen;

	struct brcmf_bss_info_le *bss_info_le;

	struct brcmf_bss_info_le *bss = NULL;

	u32 bi_length;
@@ -3181,11 +3182,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, 


	if (status == BRCMF_E_STATUS_PARTIAL) {

		brcmf_dbg(SCAN, "ESCAN Partial result\n");

		if (e->datalen < sizeof(*escan_result_le)) {

			brcmf_err("invalid event data length\n");

			goto exit;

		}

		escan_result_le = (struct brcmf_escan_result_le *) data;

		if (!escan_result_le) {

			brcmf_err("Invalid escan result (NULL pointer)\n");

			goto exit;

		}

		escan_buflen = le32_to_cpu(escan_result_le->buflen);

		if (escan_buflen > BRCMF_ESCAN_BUF_SIZE ||

		    escan_buflen > e->datalen ||

		    escan_buflen < sizeof(*escan_result_le)) {

			brcmf_err("Invalid escan buffer length: %d\n",

				  escan_buflen);

			goto exit;

		}

		if (le16_to_cpu(escan_result_le->bss_count) != 1) {

			brcmf_err("Invalid bss_count %d: ignoring\n",

				  escan_result_le->bss_count);
@@ -3202,9 +3215,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, 
		}



		bi_length = le32_to_cpu(bss_info_le->length);

		if (bi_length != (le32_to_cpu(escan_result_le->buflen) -

					WL_ESCAN_RESULTS_FIXED_SIZE)) {

			brcmf_err("Invalid bss_info length %d: ignoring\n",

		if (bi_length != escan_buflen -	WL_ESCAN_RESULTS_FIXED_SIZE) {

			brcmf_err("Ignoring invalid bss_info length: %d\n",

				  bi_length);

			goto exit;

		}