Re: [PATCH v2] wifi: rtw89: cap firmware section_num before parsing

[Ping-Ke Shih]

Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx> wrote:

> rtw89_fw_bin_info.section_info has FWDL_SECTION_MAX_NUM (10) entries.
> The v0/v1 header parsers take section_num from an 8-bit firmware field
> (0..255) and write info->section_info[i] with no cap.
> rtw89_fw_download_suit() keeps that object on the stack, so a crafted
> firmware blob overflows the stack.
> 
> Reject a truncated header and a section table that does not fit in the
> firmware image before reading fw_hdr->sections[i].
> 
> Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Acked-by: Ping-Ke Shih <pkshih@xxxxxxxxxxx>
> Signed-off-by: Laxman Acharya Padhya <acharyalaxman8848@xxxxxxxxx>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

273b0a8be083 wifi: rtw89: cap firmware section_num before parsing

---
https://github.com/pkshih/rtw.git