From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f100.google.com (mail-oo1-f100.google.com [209.85.161.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8837420895 for ; Tue, 7 Jul 2026 11:32:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.100 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783423936; cv=none; b=f+yjZmGC5gTEVOBBZU/f06L6G8S+0zy/Sqah8EPiw7d8erVdIzv1tK0DmK7Vqpal20vVvxpKh8uz3lmAV/u0ZLGaEsVp3udAZfQr/Gc8g9hcYFyKnKOFIXUVSI7IOWkls2RjdSMK+jhMVWq6UZj9DTTMl5xZd+2C+97ActGC9zw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783423936; c=relaxed/simple; bh=nnvomAEpu0wEat20NTObqGZb5UC503NtBfolCZLb92M=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=sHuo+5JqgnNnJuD2Bqu6jUkKl5U+YWSvaTXtntWPFNJoolbiBzOM8QB+8UTrhtR7fpjIHdmMBtWa/gix4J5XMo/lYgkR0D8LXdFSjdDErjY0U2GCvbSCJ26d3rSpvOceA1yn4ZroCVqeQFYzOoeWEK5TEQITxc93kRh5kACajKY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com; spf=fail smtp.mailfrom=broadcom.com; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b=FL+kY/2N; arc=none smtp.client-ip=209.85.161.100 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=broadcom.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=broadcom.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=broadcom.com header.i=@broadcom.com header.b="FL+kY/2N" Received: by mail-oo1-f100.google.com with SMTP id 006d021491bc7-6a19a5691bbso2807058eaf.3 for ; Tue, 07 Jul 2026 04:32:14 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783423934; x=1784028734; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:dkim-signature:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=YJ5QiKQH3VtcXnw6BGy4lgO2MoGjRkeKal0uvLeH+uQ=; b=nvaKlFmkDNfjpv9z8ChvTsX0+y75gIdin+7MDDVocEG1EV4wXVAe9BMVvMhbAbYDUM DRjNtBfIC9aRL557nOy6qGBgiu0TJAXc6kPLHwHh2sutN3LFzZm1pegXYEuOBGO7RxKS 8ee0Cz6Pn+wzfQmzDLKCPrHh8XLba/HWUEOhX4uPxSgHE/NdGySXUFLQTMaLkEVUQIQ/ 7fH1qVnjix9jN25i9PR2XeKr5vWhgn/6t4y1iim0IvVoXFqXKQV06K3woFtqawUn75R2 tMU1uyQ5JaNkLGVWX3zO7fl1fOGAgN9+DB/FgzSEBkD628j7A9nSVS6cQLFajRG2XA5u /f1g== X-Forwarded-Encrypted: i=1; AFNElJ8xFN13d+T59Fn9tOe7iYr2S7yhSs5PVmriQNrnImVrUc0MLYKHb6kXnEuhzd1/7BEXtt8qObye4tQGUbY=@vger.kernel.org X-Gm-Message-State: AOJu0YxIKL3SazbvpcS4Km7RG/es98iy3gaXsA46o3djGvZRAjhxk6Uv zN2VATsrbRnz/KNB1/gVVkUxEOdEg8A1ado1fvFDYHW/N1qJRY4yWGJ6XpWzYTHBoLpCEoGT1ml jbay5TECM3Z+7tLhiGjyeAdBbXmphyvtkwXCkb+7VPBa4AMrfZp2IU3JhOJ8VeKjVVHTy3RyDGV RUB+ZpQudIbVWBKjujyFu8Ji+my6uDlwVRIX+3uOZ4INO0t2RGk6Smq9FHJlk4hb945MsNAnN4w fURd4aGVglf/GaYmKqLceivqw== X-Gm-Gg: AfdE7ckhS3FIJZc2bR+/X+vKjoYjM6i7svVBMhJ94vzAK9uxdQsHsAWOoox7GBf2pFp /NCAxt5TKZdSNaMhI4qdyJ75DGF7G57agC9PVZhQLevfUSRna0C59Oe0oeLhiIb+ResSAHO7cmp 8SSqFtJztRbTHh67WsId3Y6qS4HuTWFrzhutwuQkBsMHOpmq/l0BfB45bebUgBun9Ts3v8lfhhS YiHMzuE2Nzts4zzA24MHJaFPi7gAbImgmqOpk/GrtwTwdLsoEimGpzfWi7YRGzBWZBVi07+Ccg2 XQfx2y+vHlisd5VIx3gxW6fRujz7WPMv8FGgwqBGXMARmlF1B3Y7AlWl0CXfwn9SccB1byzK/w2 5sZgvevP0sIsdBunUM3BYTr+uwI0kC43tyWxV0ZTUcSxCXxYhLln9mUpAu1v/5X1aNuy2hP3e2G SfaFRSNQGT88blLbtCofco4Gb4A6XAGdzX5/eAD+7PFIAFCGGSwQ== X-Received: by 2002:a05:6820:4de9:b0:6a1:9814:98ec with SMTP id 006d021491bc7-6a3553a20femr3018667eaf.30.1783423933698; Tue, 07 Jul 2026 04:32:13 -0700 (PDT) Received: from smtp-us-east1-p01-i01-si01.dlp.protect.broadcom.com (address-144-49-247-11.dlp.protect.broadcom.com. [144.49.247.11]) by smtp-relay.gmail.com with ESMTPS id 006d021491bc7-6a3103df4bbsm856478eaf.24.2026.07.07.04.32.12 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 07 Jul 2026 04:32:13 -0700 (PDT) X-Relaying-Domain: broadcom.com X-CFilter-Loop: Reflected Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-51c01ff996dso55535051cf.2 for ; Tue, 07 Jul 2026 04:32:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; t=1783423932; x=1784028732; darn=vger.kernel.org; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:from:to:cc:subject:date:message-id:reply-to :content-type; bh=YJ5QiKQH3VtcXnw6BGy4lgO2MoGjRkeKal0uvLeH+uQ=; b=FL+kY/2Ntl9zvm1VmfXY3isCz0qeaPptoayjX0QrWWgCtkwbuOccsYsG0FpDoF6Lmn UDMXQUvkrIgwuYjkJ2oeexzmabOcgibnfvNGpW3IWdGg074kP6oGYLIl5YzGGFHX9m6s b292OAmzKXfclE07K/g/5Abr8w+dPBOFanO6c= X-Forwarded-Encrypted: i=1; AHgh+RolAF8aR2AG9Gx8ENhSVOj7wzxvRjK00kbK3BlHzzPlBWXfTI4PiG+T+E1ENELB3gyChlQoH3WJqfaT3tE=@vger.kernel.org X-Received: by 2002:a05:622a:2516:b0:51c:7b12:11fe with SMTP id d75a77b69052e-51c7b121745mr20758671cf.76.1783423931785; Tue, 07 Jul 2026 04:32:11 -0700 (PDT) X-Received: by 2002:a05:622a:2516:b0:51c:7b12:11fe with SMTP id d75a77b69052e-51c7b121745mr20758181cf.76.1783423931150; Tue, 07 Jul 2026 04:32:11 -0700 (PDT) Received: from [10.176.2.33] ([192.19.176.250]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51c41d7eb26sm111016721cf.21.2026.07.07.04.32.08 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 07 Jul 2026 04:32:09 -0700 (PDT) Message-ID: <77dfa2f3-296f-470b-8d21-0f10a56a2a4a@broadcom.com> Date: Tue, 7 Jul 2026 13:32:09 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v2] wifi: brcmfmac: cyw: fix heap overflow on a short auth frame To: Maoyi Xie Cc: linux-wireless@vger.kernel.org, brcm80211@lists.linux.dev, brcm80211-dev-list.pdl@broadcom.com, linux-kernel@vger.kernel.org References: <20260707063155.3099999-1-maoyixie.tju@gmail.com> Content-Language: en-US From: Arend van Spriel In-Reply-To: <20260707063155.3099999-1-maoyixie.tju@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-DetectorID-Processed: b00c1d49-9d2e-4205-b15f-d015386d3d5e On 07/07/2026 08:31, Maoyi Xie wrote: > brcmf_notify_auth_frame_rx() takes the frame length from the firmware > event and copies the frame body with the management header offset > subtracted: > > u32 mgmt_frame_len = e->datalen - sizeof(struct brcmf_rx_mgmt_data); > ... > memcpy(&mgmt_frame->u, frame, > mgmt_frame_len - offsetof(struct ieee80211_mgmt, u)); > > The only length check is e->datalen >= sizeof(*rxframe), so mgmt_frame_len > can be anything from 0 up. offsetof(struct ieee80211_mgmt, u) is 24. When > mgmt_frame_len is below that, the subtraction wraps as an unsigned value to > a huge length. The memcpy then runs far past the kzalloc'd buffer. A > malicious or malfunctioning AP can make the frame short during the > external SAE auth exchange, so this is a remotely triggered heap overflow. > > Reject frames shorter than the management header offset before the copy. > > Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE authentication in station mode") > Cc: stable@vger.kernel.org > Co-developed-by: Kaixuan Li > Signed-off-by: Kaixuan Li > Signed-off-by: Maoyi Xie > Acked-by: Arend van Spriel Thanks. Nothing to add here. > --- > v2: drop the Link: tag (Arend), add Arend's Acked-by. > > v1: https://lore.kernel.org/r/20260627131313.3878893-1-maoyixie.tju@gmail.com > drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c | 6 ++++++ > 1 file changed, 6 insertions(+)