github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mwifiex: validate GET_HW_SPEC TLV lengths before parsing

Browse Source 
Validate TLV lengths before accessing TLV payloads in
mwifiex_ret_get_hw_spec().

Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>
Link: https://patch.msgid.link/20261012123624.3147417-3-jeff.chen_1@oss.nxp.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Jeff Chen 2026-10-12 20:36:24 +08:00 committed by Johannes Berg
parent 958f20d5aa
commit fbcdcc450c
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/net/wireless/marvell/mwifiex/cmdevt.c
View File

@ -1494,6 +1494,7 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv,
struct hw_spec_max_conn *max_conn;
u16 resp_size, api_id;
int i, left_len, parsed_len = 0;
int tlv_len;
adapter->fw_cap_info = le32_to_cpu(hw_spec->fw_cap_info);
@ -1559,8 +1560,16 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv,
left_len = resp_size - sizeof(struct host_cmd_ds_get_hw_spec);
while (left_len > sizeof(struct mwifiex_ie_types_header)) {
tlv = (void *)&hw_spec->tlvs + parsed_len;
tlv_len = sizeof(*tlv) + le16_to_cpu(tlv->len);
if (tlv_len > left_len)
break;
switch (le16_to_cpu(tlv->type)) {
case TLV_TYPE_API_REV:
if (tlv_len < sizeof(struct hw_spec_api_rev))
break;
api_rev = (struct hw_spec_api_rev *)tlv;
api_id = le16_to_cpu(api_rev->api_id);
switch (api_id) {
@ -1613,6 +1622,9 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv,
}
break;
case TLV_TYPE_MAX_CONN:
if (tlv_len < sizeof(struct hw_spec_max_conn))
break;
max_conn = (struct hw_spec_max_conn *)tlv;
adapter->max_p2p_conn = max_conn->max_p2p_conn;
adapter->max_sta_conn = max_conn->max_sta_conn;