| Message ID | 20221116095348.494518-1-linuxlovemin@yonsei.ac.kr (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | wifi: brcmfmac: Fix potential slab-out-of-bounds read in brcmf_inform_single_bss() | expand |
Hi Minsuk,
Thank you for the patch! Perhaps something to improve:
[auto build test WARNING on wireless-next/main]
[also build test WARNING on wireless/main linus/master v6.1-rc5 next-20221116]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Minsuk-Kang/wifi-brcmfmac-Fix-potential-slab-out-of-bounds-read-in-brcmf_inform_single_bss/20221116-175549
base: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
patch link: https://lore.kernel.org/r/20221116095348.494518-1-linuxlovemin%40yonsei.ac.kr
patch subject: [PATCH] wifi: brcmfmac: Fix potential slab-out-of-bounds read in brcmf_inform_single_bss()
config: m68k-allyesconfig
compiler: m68k-linux-gcc (GCC) 12.1.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/intel-lab-lkp/linux/commit/0b574f3e597d4f4ebf333126a83783602780d23b
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Minsuk-Kang/wifi-brcmfmac-Fix-potential-slab-out-of-bounds-read-in-brcmf_inform_single_bss/20221116-175549
git checkout 0b574f3e597d4f4ebf333126a83783602780d23b
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross W=1 O=build_dir ARCH=m68k SHELL=/bin/bash drivers/net/wireless/
If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@intel.com>
All warnings (new ones prefixed by >>):
In file included from include/linux/device.h:15,
from include/linux/dma-mapping.h:7,
from include/linux/skbuff.h:31,
from include/linux/if_ether.h:19,
from include/linux/etherdevice.h:20,
from drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:9:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_inform_single_bss':
>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h:59:50: warning: format '%lu' expects argument of type 'long unsigned int', but argument 5 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
59 | wiphy_err((drvr)->wiphy, "%s: " fmt, __func__, \
| ^~~~~~
include/linux/dev_printk.h:110:30: note: in definition of macro 'dev_printk_index_wrap'
110 | _p_func(dev, fmt, ##__VA_ARGS__); \
| ^~~
include/linux/dev_printk.h:144:56: note: in expansion of macro 'dev_fmt'
144 | dev_printk_index_wrap(_dev_err, KERN_ERR, dev, dev_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~
include/net/cfg80211.h:8794:9: note: in expansion of macro 'dev_err'
8794 | dev_err(&(wiphy)->dev, format, ##args)
| ^~~~~~~
drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h:59:25: note: in expansion of macro 'wiphy_err'
59 | wiphy_err((drvr)->wiphy, "%s: " fmt, __func__, \
| ^~~~~~~~~
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3303:17: note: in expansion of macro 'bphy_err'
3303 | bphy_err(drvr, "Invalid information element offset: %u, length: %lu\n",
| ^~~~~~~~
vim +59 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
5e8149f5036afe drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h Arend van Spriel 2012-12-07 53
16e64676839633 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h Rafał Miłecki 2019-02-15 54 #define bphy_err(drvr, fmt, ...) \
3ef005b82e2ad6 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h Rafał Miłecki 2019-01-16 55 do { \
3ef005b82e2ad6 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h Rafał Miłecki 2019-01-16 56 if (IS_ENABLED(CONFIG_BRCMDBG) || \
3ef005b82e2ad6 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h Rafał Miłecki 2019-01-16 57 IS_ENABLED(CONFIG_BRCM_TRACING) || \
3ef005b82e2ad6 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h Rafał Miłecki 2019-01-16 58 net_ratelimit()) \
16e64676839633 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h Rafał Miłecki 2019-02-15 @59 wiphy_err((drvr)->wiphy, "%s: " fmt, __func__, \
3ef005b82e2ad6 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h Rafał Miłecki 2019-01-16 60 ##__VA_ARGS__); \
3ef005b82e2ad6 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h Rafał Miłecki 2019-01-16 61 } while (0)
3ef005b82e2ad6 drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h Rafał Miłecki 2019-01-16 62
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index ae9507dec74a..8390274a8ab1 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -3298,6 +3298,13 @@ static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg, notify_ielen = le32_to_cpu(bi->ie_length); bss_data.signal = (s16)le16_to_cpu(bi->RSSI) * 100; + if ((unsigned long)notify_ie + notify_ielen - + (unsigned long)cfg->escan_info.escan_buf > BRCMF_ESCAN_BUF_SIZE) { + bphy_err(drvr, "Invalid information element offset: %u, length: %lu\n", + le16_to_cpu(bi->ie_offset), notify_ielen); + return -EINVAL; + } + brcmf_dbg(CONN, "bssid: %pM\n", bi->BSSID); brcmf_dbg(CONN, "Channel: %d(%d)\n", channel, freq); brcmf_dbg(CONN, "Capability: %X\n", notify_capability);