[PATCH] wifi: mwifiex: validate intf_num in multi-channel event

[Aamir Ahmed]

The mwifiex_process_multi_chan_event() function uses grp_info->intf_num
from the firmware as a loop bound to index into the bss_type_numlist[]
flexible array member. However, intf_num is not validated against the
TLV data length (tlv_len), so a malicious USB device (or corrupted
firmware response) can set intf_num larger than the actual array entries
in the TLV, causing an out-of-bounds read past the TLV data.

Add a validation check to ensure that the TLV data is large enough to
contain intf_num entries in bss_type_numlist[].

Fixes: 2b0f997db43f ("mwifiex: add usb multi channel event process support")
Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
---
 drivers/net/wireless/marvell/mwifiex/sta_event.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_event.c b/drivers/net/wireless/marvell/mwifiex/sta_event.c
index fecd88967ceb..b17ff263489f 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_event.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_event.c
@@ -450,6 +450,9 @@ void mwifiex_process_multi_chan_event(struct mwifiex_private *priv,
 
 		grp_info = (struct mwifiex_ie_types_mc_group_info *)tlv;
 		intf_num = grp_info->intf_num;
+		if (tlv_len < sizeof(*grp_info) -
+			      sizeof(grp_info->header) + intf_num)
+			break;
 		for (i = 0; i < intf_num; i++) {
 			bss_type = grp_info->bss_type_numlist[i] >> 4;
 			bss_num = grp_info->bss_type_numlist[i] & BSS_NUM_MASK;
-- 
2.43.0