[PATCH] wifi: mwifiex: validate scan response TLV lengths

[Aamir Ahmed]

The scan response handler mwifiex_ret_802_11_scan() has three issues
when processing firmware responses:

1) bss_descript_size is not validated against resp->size before being
   used to compute tlv_buf_size.  If the firmware sends a
   bss_descript_size larger than the response, the subtraction wraps
   to a huge u32 value, causing the TLV search to read past the
   response buffer.

2) The TSF timestamp TLV data is indexed by number_of_sets * TSF_DATA_SIZE
   without checking that the TLV header.len is large enough.  A firmware
   response with number_of_sets=64 but a TSF TLV with only a few bytes
   causes an out-of-bounds heap read.

3) The channel-band TLV is indexed by number_of_sets without checking
   that the TLV has enough chan_band_param entries.  Same OOB read as
   above.

Add validation for all three: reject responses where bss_descript_size
exceeds the response, and invalidate TSF/chan-band TLVs whose reported
lengths are too short for the number of BSS entries.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
---
 drivers/net/wireless/marvell/mwifiex/scan.c | 27 ++++++++++++++++++---
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 97c0ec3b822e..4d0f3c412a90 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -2137,11 +2137,18 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 	bss_info = scan_rsp->bss_desc_and_tlv_buffer;
 
 	/*
-	 * The size of the TLV buffer is equal to the entire command response
-	 *   size (scan_resp_size) minus the fixed fields (sizeof()'s), the
-	 *   BSS Descriptions (bss_descript_size as bytesLef) and the command
-	 *   response header (S_DS_GEN)
+	 * Validate that bss_descript_size fits within the response to
+	 * prevent an underflow in the TLV buffer size computation below.
 	 */
+	if (bytes_left + sizeof(scan_rsp->bss_descript_size) +
+	    sizeof(scan_rsp->number_of_sets) + S_DS_GEN > scan_resp_size) {
+		mwifiex_dbg(adapter, ERROR,
+			    "SCAN_RESP: bss_descript_size %u exceeds resp size %u\n",
+			    bytes_left, scan_resp_size);
+		ret = -1;
+		goto check_next_scan;
+	}
+
 	tlv_buf_size = scan_resp_size - (bytes_left
 					 + sizeof(scan_rsp->bss_descript_size)
 					 + sizeof(scan_rsp->number_of_sets)
@@ -2158,6 +2165,12 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 					     (struct mwifiex_ie_types_data **)
 					     &tsf_tlv);
 
+	/* Validate TSF TLV has enough data for all reported BSS entries */
+	if (tsf_tlv &&
+	    le16_to_cpu(tsf_tlv->header.len) <
+	    scan_rsp->number_of_sets * TSF_DATA_SIZE)
+		tsf_tlv = NULL;
+
 	/* Search the TLV buffer space in the scan response for any valid
 	   TLVs */
 	mwifiex_ret_802_11_scan_get_tlv_ptrs(adapter, tlv_data, tlv_buf_size,
@@ -2165,6 +2178,12 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
 					     (struct mwifiex_ie_types_data **)
 					     &chan_band_tlv);
 
+	/* Validate chan-band TLV has enough entries for all reported BSS */
+	if (chan_band_tlv &&
+	    le16_to_cpu(chan_band_tlv->header.len) <
+	    scan_rsp->number_of_sets * sizeof(struct chan_band_param_set))
+		chan_band_tlv = NULL;
+
 #ifdef CONFIG_PM
 	if (priv->wdev.wiphy->wowlan_config)
 		nd_config = priv->wdev.wiphy->wowlan_config->nd_config;
-- 
2.43.0