Re: [PATCH v2] wifi: brcmfmac: cyw: fix heap overflow on a short auth frame

[Arend van Spriel]

On 07/07/2026 13:32, Arend van Spriel wrote:
> On 07/07/2026 08:31, Maoyi Xie wrote:
> > brcmf_notify_auth_frame_rx() takes the frame length from the firmware
> > event and copies the frame body with the management header offset
> > subtracted:
> >
> >     u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data);
> >     ...
> >     memcpy(&mgmt_frame->u, frame,
> >            mgmt_frame_len - offsetof(struct ieee80211_mgmt, u));
> >
> > The only length check is e->datalen >= sizeof(*rxframe), so 
> > mgmt_frame_len
> > can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When
> > mgmt_frame_len is below that, the subtraction wraps as an unsigned 
> > value to
> > a huge length. The memcpy then runs far past the kzalloc'd buffer. A
> > malicious or malfunctioning AP can make the frame short during the
> > external SAE auth exchange, so this is a remotely triggered heap 
> > overflow.
> >
> > Reject frames shorter than the management header offset before the copy.
> >
> > Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE 
> > authentication in station mode")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Co-developed-by: Kaixuan Li <kaixuan.li@xxxxxxxxxx>
> > Signed-off-by: Kaixuan Li <kaixuan.li@xxxxxxxxxx>
> > Signed-off-by: Maoyi Xie <maoyixie.tju@xxxxxxxxx>
> > Acked-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>
>
> Thanks. Nothing to add here.

Actually v1 was already applied to the wireless tree.

> > ---
> > v2: drop the Link: tag (Arend), add Arend's Acked-by.
> >
> > v1: https://lore.kernel.org/r/20260627131313.3878893-1- 
> > maoyixie.tju@xxxxxxxxx
> >   drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 6 ++++++
> >   1 file changed, 6 insertions(+)