[PATCH] net: wwan: t7xx: validate the HS2 message data length

[Guanglei Zhu]

control_msg_handler() passes the modem-supplied data_length field of a
CTL_ID_HS2_MSG message straight to t7xx_fsm_append_event(), which
memcpy()s that many bytes out of the skb.  Nothing compares the field
with the actual length of the message, so a modem reporting a larger
data_length makes the driver read past the end of the skb and store
kernel heap memory in the FSM event.

0e7c074cfcd9 ("net: wwan: t7xx: validate port_count against message
length in t7xx_port_enum_msg_handler") added this kind of check for
the port enumeration path but missed the handshake path.

Reject the message when data_length does not fit into the skb.

Fixes: da45d2566a1d ("net: wwan: t7xx: Add control port")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guanglei Zhu <zhugl3@xxxxxxxxxxxx>
---

Verified in a QEMU guest with a fault injector feeding the driver's
control port thread a handshake message whose data_length exceeds the
skb: the unpatched driver trips KASAN on a read of 8192 bytes past a
500-byte payload, and the extra bytes land in the FSM event.  With
this check the message is rejected, and well-formed handshakes are
unaffected.
 drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c
index f869e4ed9..0f2ead8a7 100644
--- a/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c
+++ b/drivers/net/wwan/t7xx/t7xx_port_ctrl_msg.c
@@ -178,22 +178,32 @@ static int control_msg_handler(struct t7xx_port *port, struct sk_buff *skb)
 
 	ctrl_msg_h = (struct ctrl_msg_header *)skb->data;
 	switch (le32_to_cpu(ctrl_msg_h->ctrl_msg_id)) {
-	case CTL_ID_HS2_MSG:
+	case CTL_ID_HS2_MSG: {
+		u32 data_length;
+
 		skb_pull(skb, sizeof(*ctrl_msg_h));
+		data_length = le32_to_cpu(ctrl_msg_h->data_length);
 
 		if (port_conf->rx_ch == PORT_CH_CONTROL_RX ||
 		    port_conf->rx_ch == PORT_CH_AP_CONTROL_RX) {
 			int event = port_conf->rx_ch == PORT_CH_CONTROL_RX ?
 				    FSM_EVENT_MD_HS2 : FSM_EVENT_AP_HS2;
 
-			ret = t7xx_fsm_append_event(ctl, event, skb->data,
-						    le32_to_cpu(ctrl_msg_h->data_length));
-			if (ret)
-				dev_err(port->dev, "Failed to append Handshake 2 event");
+			if (data_length > skb->len) {
+				dev_err(port->dev, "Invalid HS2 message length %u\n",
+					data_length);
+				ret = -EINVAL;
+			} else {
+				ret = t7xx_fsm_append_event(ctl, event, skb->data,
+							    data_length);
+				if (ret)
+					dev_err(port->dev, "Failed to append Handshake 2 event");
+			}
 		}
 
 		dev_kfree_skb_any(skb);
 		break;
+	}
 
 	case CTL_ID_MD_EX:
 	case CTL_ID_MD_EX_ACK:
-- 
2.43.0