[PATCH 0/2] wifi: nxpwifi: fix the host-MLME authentication frame path

[Linmao Li]

Two fixes to nxpwifi_cfg80211_authenticate(), found by reading the code
rather than by hitting them on hardware.

Patch 1 is the one that matters.  The frame length is kept in a single u16
that conflates two different lengths and gets both wrong.  req->ie_len and
req->auth_data_len are both size_t; the IE policy caps req->ie_len at
IEEE80211_MAX_DATA_LEN, but NL80211_ATTR_AUTH_DATA has only a four-byte
minimum, and nla_len is a u16, so one auth data attribute can carry 65531
bytes - enough for the sum to wrap when it is assigned to the u16.  With
auth_data_len == 65510 and no IEs the length becomes 6, kzalloc(6)
succeeds, and the copy below writes 65506 user-provided bytes past a
6-byte heap object.  Separately, NXPWIFI_MGMT_HEADER_LEN already
accounts for the address4 that nxpwifi_form_mgmt_frame() splices in, so
that helper is asked to append ETH_ALEN to a length that already included
it and overruns the skb tailroom by six bytes; SKB_DATA_ALIGN() slack
normally hides it.

The patch keeps the 3-address length the driver builds separate from the
longer frame the firmware sees, and rejects lengths that cannot be
represented once address4 is added.  The value handed to the firmware does
not change for frames that were already valid.

Patch 2 is the small one: the same function never checks that kzalloc(),
and leaks the buffer when dev_alloc_skb() fails.

Reaching patch 1's overflow needs CAP_NET_ADMIN in the netns user namespace
(NL80211_CMD_AUTHENTICATE is GENL_UNS_ADMIN_PERM), an up netdev, and a
suitable STA/BSS/SAE state.  I have not written a reproducer or looked at
exploitability, so I would describe it as user-influenced heap corruption
and leave it there.

mwifiex has the same length handling in mwifiex_cfg80211_authenticate() -
it is where this code came from - and it is in mainline since v6.12.  That
needs its own fix against the fixes tree rather than being folded in here;
I did not want to mix a wireless-next driver with a stable-bound one.

Compile-tested only (allmodconfig, W=1, drivers/net/wireless/nxp/ clean).
I do not have IW61x hardware.

Linmao Li (2):
  wifi: nxpwifi: fix the authentication frame length handling
  wifi: nxpwifi: handle authentication frame allocation failures

 drivers/net/wireless/nxp/nxpwifi/cfg80211.c | 24 ++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)


base-commit: ca800a9302764c445de0da0e84d2252400a770ee
-- 
2.25.1