RE: [PATCH 0/4] wifi: iwlwifi: harden netdetect resume-path parsing against firmware-controlled inputs (mvm + mld)

[Korenblit, Miriam Rachel]

> -----Original Message-----
> From: Michael Bommarito <michael.bommarito@xxxxxxxxx>
> Sent: Friday, May 15, 2026 3:11 PM
> To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@xxxxxxxxx>
> Cc: Berg, Johannes <johannes.berg@xxxxxxxxx>; Grumbach, Emmanuel
> <emmanuel.grumbach@xxxxxxxxx>; linux-wireless@xxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; stable@xxxxxxxxxxxxxxx
> Subject: [PATCH 0/4] wifi: iwlwifi: harden netdetect resume-path parsing against
> firmware-controlled inputs (mvm + mld)
> 
> Four defensive bound-check additions on the WoWLAN net-detect resume path in
> iwlwifi, validating firmware-controlled response lengths and bitmap-bit positions
> at the host/firmware trust boundary. Two patches each in the mvm and mld op-
> modes; both op-modes are live in current kernels (mvm drives 7000-series
> through pre-BE200 hardware; mld drives Wi-Fi 7 / BE200+ when
> CONFIG_IWLMLD is enabled).
> 
> The series is in the same shape as the recently fixed sibling commit 744fabc338e8
> ("wifi: iwlwifi: mvm: fix potential out-of-bounds read in
> iwl_mvm_nd_match_info_handler()"), which landed in stable on 2026-04-11.
> Well-behaved firmware should not trigger any of these, but the host parser
> should not depend on that.
> 
> Patches 1 + 3: length-tail guard on the firmware response.
> iwl_mvm_netdetect_query_results() and
> iwl_mld_netdetect_match_info_handler() validate only the fixed header size of
> the response/notification, then memcpy the flex- array tail unconditionally. A
> response of exactly query_len /
> sizeof(*notif) bytes passes the guard and the memcpy reads matches_len /
> NETDETECT_QUERY_BUF_LEN bytes of adjacent slab content. KASAN reports the
> slab-out-of-bounds READ "0 bytes to the right of the allocated 24-byte region" in
> the kmalloc-32 cache. Same fix shape as the sibling.
> 
> Patches 2 + 4: clamp the channel-iteration upper bound against the netdetect
> channels-table length. iwl_mvm_query_set_freqs() and
> iwl_mld_set_netdetect_info() iterate the per-match matching_channels[] bitmap
> and index a channels[] pointer table by bit position, without bounding the bit
> positions against the table length. The pre-existing caller-side guards compare
> popcount to table length, not bit position to table length. The mvm path iterates
> over the full 0..55 bit range; the mld path is accidentally bounded to 0..6 by a
> bits-vs-bytes confusion
> (for_each_set_bit() takes bits, but the call passes sizeof(...) which is 7 bytes). Both
> can index past the channels[] allocation when the user's net-detect configuration
> has fewer channels than the relevant bound. The wild-pointer dereference of
> channels[j]->center_freq inside the resume work-queue then page- faults the
> kernel; a KUnit harness exercising the mvm shape panics with
> 
>   Kernel panic - not syncing: Segfault with no mm
> 
> and the mld shape panics identically when n_channels < 7. The mld fix folds the
> bits-vs-bytes correction together with the clamp because applying only the bits-
> correction without the clamp would widen the OOB exposure from j < 7 to j < 56.
> 
> All four bugs require the firmware to produce inputs outside the implied driver
> contract: a short response (patches 1, 3), or matching_channels[] bits set at
> positions outside the channels- table bound (patches 2, 4). Well-behaved
> firmware should not do either. The patches add defensive validation at a trust
> boundary; they are not a claim that current Intel firmware misbehaves.
> 
> Reproducer: self-contained KUnit suite that lifts all four buggy code paths into
> standalone harnesses (no firmware or hardware dependency, ~10s on UML).
> Patched-shape subtests pass cleanly under the proposed fixes
> (test_patched_rejects_short, test_patched_accepts_full,
> test_set_freqs_patched_clamps, test_mld_match_info_patched_rejects_short,
> test_mld_set_freqs_patched_clamps).
> 
> All four patches build clean under x86_64 allmodconfig with no new warnings;
> checkpatch --strict reports 0/0/0 on each.
> 
> Michael Bommarito (4):
>   wifi: iwlwifi: mvm: include matches_len in scan-offload-query length
>     check
>   wifi: iwlwifi: mvm: clamp set_freqs iteration to n_nd_channels
>   wifi: iwlwifi: mld: include matches tail in match-info length check
>   wifi: iwlwifi: mld: clamp netdetect channel iteration to n_channels
> 
>  drivers/net/wireless/intel/iwlwifi/mld/d3.c | 20 +++++++++++++++-----
> drivers/net/wireless/intel/iwlwifi/mvm/d3.c | 10 +++++++---
>  2 files changed, 22 insertions(+), 8 deletions(-)
> 

Hi Michael,
Thank you for your time and your fixes 😊

2 of those were already fixed internally,
But the 2 'clamp' ones are not. Will comment on those separately.

Miri
---
> --
> 2.53.0