| Message ID | 06668edd68e7a26bbfeebd1201ae077a2a7a8bce.1692931954.git.gustavoars@kernel.org |
|---|---|
| State | New |
| Headers | show |
| Series | wifi: mwifiex: Fix tlv_buf_left calculation and replace one-element array | expand |
On Thu, Aug 24, 2023 at 09:06:51PM -0600, Gustavo A. R. Silva wrote: > In a TLV encoding scheme, the Length part represents the length after > the header containing the values for type and length. In this case, > `tlv_len` should be: > > tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len > > Notice that the `- 1` accounts for the one-element array `bitmap`, which > 1-byte size is already included in `sizeof(*tlv_rxba)`. > > So, if the above is correct, there is a double-counting of some members > in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp` > are calculated: > > 968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len); > 969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba); > > in specific, members: > > drivers/net/wireless/marvell/mwifiex/fw.h:777 > 777 u8 mac[ETH_ALEN]; > 778 u8 tid; > 779 u8 reserved; > 780 __le16 seq_num; > 781 __le16 bitmap_len; > > This is clearly wrong, and affects the subsequent decoding of data in > `event_buf` through `tlv_rxba`: > > 970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp; > > Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)` > in the calculation of `tlv_buf_left` and `tmp`. > > This results in the following binary differences before/after changes: > > | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o > | @@ -4698,11 +4698,11 @@ > | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968 > | tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len); > | - 1da7: lea -0x11(%rbx),%edx > | + 1da7: lea -0x4(%rbx),%edx > | 1daa: movzwl %bp,%eax > | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969 > | tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len; > | - 1dad: lea 0x11(%r15,%rbp,1),%r15 > | + 1dad: lea 0x4(%r15,%rbp,1),%r15 > > The above reflects the desired change: avoid counting 13 too many bytes; > which is the total size of the double-counted members in > `struct mwifiex_ie_types_rxba_sync`: > > $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o > struct mwifiex_ie_types_rxba_sync { > struct mwifiex_ie_types_header header; /* 0 4 */ > > |----------------------------------------------------------------------- > | u8 mac[6]; /* 4 6 */ | > | u8 tid; /* 10 1 */ | > | u8 reserved; /* 11 1 */ | > | __le16 seq_num; /* 12 2 */ | > | __le16 bitmap_len; /* 14 2 */ | > | u8 bitmap[1]; /* 16 1 */ | > |----------------------------------------------------------------------| > | 13 bytes| > ----------- > > /* size: 17, cachelines: 1, members: 7 */ > /* last cacheline: 17 bytes */ > } __attribute__((__packed__)); > > Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event") > Cc: stable@vger.kernel.org > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> Excellent commit log! Reviewed-by: Kees Cook <keescook@chromium.org>
"Gustavo A. R. Silva" <gustavoars@kernel.org> wrote: > In a TLV encoding scheme, the Length part represents the length after > the header containing the values for type and length. In this case, > `tlv_len` should be: > > tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len > > Notice that the `- 1` accounts for the one-element array `bitmap`, which > 1-byte size is already included in `sizeof(*tlv_rxba)`. > > So, if the above is correct, there is a double-counting of some members > in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp` > are calculated: > > 968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len); > 969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba); > > in specific, members: > > drivers/net/wireless/marvell/mwifiex/fw.h:777 > 777 u8 mac[ETH_ALEN]; > 778 u8 tid; > 779 u8 reserved; > 780 __le16 seq_num; > 781 __le16 bitmap_len; > > This is clearly wrong, and affects the subsequent decoding of data in > `event_buf` through `tlv_rxba`: > > 970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp; > > Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)` > in the calculation of `tlv_buf_left` and `tmp`. > > This results in the following binary differences before/after changes: > > | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o > | @@ -4698,11 +4698,11 @@ > | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968 > | tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len); > | - 1da7: lea -0x11(%rbx),%edx > | + 1da7: lea -0x4(%rbx),%edx > | 1daa: movzwl %bp,%eax > | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969 > | tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len; > | - 1dad: lea 0x11(%r15,%rbp,1),%r15 > | + 1dad: lea 0x4(%r15,%rbp,1),%r15 > > The above reflects the desired change: avoid counting 13 too many bytes; > which is the total size of the double-counted members in > `struct mwifiex_ie_types_rxba_sync`: > > $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o > struct mwifiex_ie_types_rxba_sync { > struct mwifiex_ie_types_header header; /* 0 4 */ > > |----------------------------------------------------------------------- > | u8 mac[6]; /* 4 6 */ | > | u8 tid; /* 10 1 */ | > | u8 reserved; /* 11 1 */ | > | __le16 seq_num; /* 12 2 */ | > | __le16 bitmap_len; /* 14 2 */ | > | u8 bitmap[1]; /* 16 1 */ | > |----------------------------------------------------------------------| > | 13 bytes| > ----------- > > /* size: 17, cachelines: 1, members: 7 */ > /* last cacheline: 17 bytes */ > } __attribute__((__packed__)); > > Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event") > Cc: stable@vger.kernel.org > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> > Reviewed-by: Kees Cook <keescook@chromium.org> 3 patches applied to wireless.git, thanks. eec679e4ac5f wifi: mwifiex: Fix tlv_buf_left calculation c7847241de28 wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync d5a93b7d2877 wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
> 3 patches applied to wireless.git, thanks. Awesome. :) > > eec679e4ac5f wifi: mwifiex: Fix tlv_buf_left calculation > c7847241de28 wifi: mwifiex: Replace one-element array with flexible-array member in struct mwifiex_ie_types_rxba_sync > d5a93b7d2877 wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len > Thanks! -- Gustavo
diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c index 391793a16adc..d1d3632a3ed7 100644 --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c @@ -965,8 +965,8 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv, } } - tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len); - tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba); + tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len); + tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len; tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp; } }
In a TLV encoding scheme, the Length part represents the length after the header containing the values for type and length. In this case, `tlv_len` should be: tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len Notice that the `- 1` accounts for the one-element array `bitmap`, which 1-byte size is already included in `sizeof(*tlv_rxba)`. So, if the above is correct, there is a double-counting of some members in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp` are calculated: 968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len); 969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba); in specific, members: drivers/net/wireless/marvell/mwifiex/fw.h:777 777 u8 mac[ETH_ALEN]; 778 u8 tid; 779 u8 reserved; 780 __le16 seq_num; 781 __le16 bitmap_len; This is clearly wrong, and affects the subsequent decoding of data in `event_buf` through `tlv_rxba`: 970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp; Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)` in the calculation of `tlv_buf_left` and `tmp`. This results in the following binary differences before/after changes: | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o | @@ -4698,11 +4698,11 @@ | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968 | tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len); | - 1da7: lea -0x11(%rbx),%edx | + 1da7: lea -0x4(%rbx),%edx | 1daa: movzwl %bp,%eax | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969 | tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len; | - 1dad: lea 0x11(%r15,%rbp,1),%r15 | + 1dad: lea 0x4(%r15,%rbp,1),%r15 The above reflects the desired change: avoid counting 13 too many bytes; which is the total size of the double-counted members in `struct mwifiex_ie_types_rxba_sync`: $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o struct mwifiex_ie_types_rxba_sync { struct mwifiex_ie_types_header header; /* 0 4 */ |----------------------------------------------------------------------- | u8 mac[6]; /* 4 6 */ | | u8 tid; /* 10 1 */ | | u8 reserved; /* 11 1 */ | | __le16 seq_num; /* 12 2 */ | | __le16 bitmap_len; /* 14 2 */ | | u8 bitmap[1]; /* 16 1 */ | |----------------------------------------------------------------------| | 13 bytes| ----------- /* size: 17, cachelines: 1, members: 7 */ /* last cacheline: 17 bytes */ } __attribute__((__packed__)); Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event") Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org> --- Changes in v2: - Fix typo in changelog text: s/too bytes/too many bytes - Update binary diff snapshot in changelog text. v1: - Link: https://lore.kernel.org/linux-hardening/698dc480d939e3ae490140db5c2f36eb84093594.1692829410.git.gustavoars@kernel.org/ drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)