* [drivers/net/wireless/marvell] Question about a possible underflow in mwifiex_11h_handle_chanrpt_ready()
@ 2024-03-14 22:21 Chenyuan Yang
2024-03-15 23:58 ` Brian Norris
0 siblings, 1 reply; 2+ messages in thread
From: Chenyuan Yang @ 2024-03-14 22:21 UTC (permalink / raw
To: briannorris, kvalo, johannes.berg, horms, trix; +Cc: linux-wireless, zzjas98
Dear MARVELL Developers,
We are curious whether the function `mwifiex_11h_handle_chanrpt_ready()` might have an underflow.
The function is https://elixir.bootlin.com/linux/v6.8/source/drivers/net/wireless/marvell/mwifiex/11h.c#L193
and the relevant code is
```
int mwifiex_11h_handle_chanrpt_ready(struct mwifiex_private *priv,
struct sk_buff *skb)
{
struct host_cmd_ds_chan_rpt_event *rpt_event;
struct mwifiex_ie_types_chan_rpt_data *rpt;
u16 event_len, tlv_len;
rpt_event = (void *)(skb->data + sizeof(u32));
event_len = skb->len - (sizeof(struct host_cmd_ds_chan_rpt_event)+
sizeof(u32));
...
while (event_len >= sizeof(struct mwifiex_ie_types_header)) {
rpt = (void *)&rpt_event->tlvbuf;
tlv_len = le16_to_cpu(rpt->header.len);
switch (le16_to_cpu(rpt->header.type)) {
case TLV_TYPE_CHANRPT_11H_BASIC:
if (rpt->map.radar) {
mwifiex_dbg(priv->adapter, MSG,
"RADAR Detected on channel %d!\n",
priv->dfs_chandef.chan->hw_value);
cancel_delayed_work_sync(&priv->dfs_cac_work);
cfg80211_cac_event(priv->netdev,
&priv->dfs_chandef,
NL80211_RADAR_DETECTED,
GFP_KERNEL);
}
break;
default:
break;
}
event_len -= (tlv_len + sizeof(rpt->header));
}
return 0;
}
```
Here if the `tlv_len + sizeof(rpt->header)` is greater than `event_len`, then `event_len` will underflow since they are both unsigned integers.
We are curious whether `event_len` is guaranteed to be greater than or equal to `tlv_len + sizeof(rpt->header)` in each iteration since we found that `sizeof(struct mwifiex_ie_types_header) == sizeof(rpt->header)`.
Please kindly correct us if we missed any key information. Looking forward to your response!
Best,
Chenyuan
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [drivers/net/wireless/marvell] Question about a possible underflow in mwifiex_11h_handle_chanrpt_ready()
2024-03-14 22:21 [drivers/net/wireless/marvell] Question about a possible underflow in mwifiex_11h_handle_chanrpt_ready() Chenyuan Yang
@ 2024-03-15 23:58 ` Brian Norris
0 siblings, 0 replies; 2+ messages in thread
From: Brian Norris @ 2024-03-15 23:58 UTC (permalink / raw
To: Chenyuan Yang; +Cc: kvalo, johannes.berg, horms, trix, linux-wireless, zzjas98
On Thu, Mar 14, 2024 at 05:21:12PM -0500, Chenyuan Yang wrote:
> We are curious whether `event_len` is guaranteed to be greater than or
> equal to `tlv_len + sizeof(rpt->header)` in each iteration since we
> found that `sizeof(struct mwifiex_ie_types_header) ==
> sizeof(rpt->header)`.
You have the code available to look at just as well as we do. I don't
see any such guarantee on first glance.
Patches welcome as always.
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
Brian
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-03-15 23:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-03-14 22:21 [drivers/net/wireless/marvell] Question about a possible underflow in mwifiex_11h_handle_chanrpt_ready() Chenyuan Yang
2024-03-15 23:58 ` Brian Norris
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).