[PATCH 0/2] wifi: p54: validate PDA entry data lengths in eeprom parser

[PATCH 0/2] wifi: p54: validate PDA entry data lengths in eeprom parser

[Shengzhuo Wei]

p54_parse_eeprom() walks the device-supplied PDA entries but some
handlers read from entry->data without first checking that the entry
actually carries the bytes they read. This series adds the missing
length validations for the two worst offenders: the PA calibration
curve data (a ~191 KB over-read) and the interface-list records.

This continues the EEPROM trust-boundary hardening of
da1b9a55ff11 and ebd6d37fa94b, which validated the readback path but
not the parser that consumes the received data.

Both over-reads were verified with KASAN reproducers of the respective
loops, and both fixes confirmed to silence them.

---
Shengzhuo Wei (2):
      wifi: p54: validate curve data length in p54_parse_eeprom()
      wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

 drivers/net/wireless/intersil/p54/eeprom.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)
---
base-commit: 66fb95a521110da673090294561844c9f76ebe64
change-id: 20260826-p54-pda-validation-7b2e91f4c6a3

Best regards,
-- 
Shengzhuo Wei <me@cherr.cc>

[PATCH 1/2] wifi: p54: validate curve data length in p54_parse_eeprom()

[Shengzhuo Wei]

p54_convert_rev0() and p54_convert_rev1() walk
channels * (2 + points_per_channel * sizeof(sample)) bytes of the
curve data entry, with both counts taken verbatim from the
device-supplied EEPROM. An entry that declares channels=255,
points_per_channel=255 but carries only the 4-byte header drives a
~191 KB slab-out-of-bounds read past the EEPROM buffer (verified with
a KASAN reproducer of the conversion loop). The sibling converters
p54_convert_output_limits() and p54_convert_db() already validate
their counts against the entry length; this path was missed.

Reject the entry when the counts do not fit in the entry data.

Fixes: eff1a59c48e3 ("[P54]: add mac80211-based driver for prism54 softmac hardware")
Cc: stable@vger.kernel.org
Assisted-by: GLM:5.3
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
 drivers/net/wireless/intersil/p54/eeprom.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
index 95580921d933827c5eac55b79404e26bd7a57ba4..968ce9a411358e0e6b83117b1a077becc3207090 100644
--- a/drivers/net/wireless/intersil/p54/eeprom.c
+++ b/drivers/net/wireless/intersil/p54/eeprom.c
@@ -763,6 +763,8 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
 		case PDR_PRISM_PA_CAL_CURVE_DATA: {
 			struct pda_pa_curve_data *curve_data =
 				(struct pda_pa_curve_data *)entry->data;
+			size_t needed;
+
 			if (data_len < sizeof(*curve_data)) {
 				err = -EINVAL;
 				goto err;
@@ -770,9 +772,23 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
 
 			switch (curve_data->cal_method_rev) {
 			case 0:
+				needed = curve_data->channels *
+					(sizeof(struct pda_pa_curve_data_sample_rev0) *
+					 curve_data->points_per_channel + 2);
+				if (data_len - sizeof(*curve_data) < needed) {
+					err = -EINVAL;
+					goto err;
+				}
 				err = p54_convert_rev0(dev, curve_data);
 				break;
 			case 1:
+				needed = curve_data->channels *
+					(sizeof(struct pda_pa_curve_data_sample_rev1) *
+					 curve_data->points_per_channel + 3);
+				if (data_len - sizeof(*curve_data) < needed) {
+					err = -EINVAL;
+					goto err;
+				}
 				err = p54_convert_rev1(dev, curve_data);
 				break;
 			default:

-- 
2.47.3

Re: [PATCH 1/2] wifi: p54: validate curve data length in p54_parse_eeprom()

[Christian Lamparter]

Hi,

On 8/26/26 7:07 PM, Shengzhuo Wei wrote:
> p54_convert_rev0() and p54_convert_rev1() walk
> channels * (2 + points_per_channel * sizeof(sample)) bytes of the
> curve data entry, with both counts taken verbatim from the
> device-supplied EEPROM. An entry that declares channels=255,
> points_per_channel=255 but carries only the 4-byte header drives a
> ~191 KB slab-out-of-bounds read past the EEPROM buffer (verified with
> a KASAN reproducer of the conversion loop). The sibling converters
> p54_convert_output_limits() and p54_convert_db() already validate
> their counts against the entry length; this path was missed.
> 
> Reject the entry when the counts do not fit in the entry data.
> 
> Fixes: eff1a59c48e3 ("[P54]: add mac80211-based driver for prism54 softmac hardware")
> Cc: stable@vger.kernel.org
> Assisted-by: GLM:5.3
> Signed-off-by: Shengzhuo Wei <me@cherr.cc>
> ---
>   drivers/net/wireless/intersil/p54/eeprom.c | 16 ++++++++++++++++
>   1 file changed, 16 insertions(+)
> 
> diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
> index 95580921d933827c5eac55b79404e26bd7a57ba4..968ce9a411358e0e6b83117b1a077becc3207090 100644
> --- a/drivers/net/wireless/intersil/p54/eeprom.c
> +++ b/drivers/net/wireless/intersil/p54/eeprom.c
> @@ -763,6 +763,8 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
>   		case PDR_PRISM_PA_CAL_CURVE_DATA: {
>   			struct pda_pa_curve_data *curve_data =
>   				(struct pda_pa_curve_data *)entry->data;
> +			size_t needed;
> +
>   			if (data_len < sizeof(*curve_data)) {
>   				err = -EINVAL;
>   				goto err;
> @@ -770,9 +772,23 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
>   
>   			switch (curve_data->cal_method_rev) {
>   			case 0:
> +				needed = curve_data->channels *
> +					(sizeof(struct pda_pa_curve_data_sample_rev0) *
> +					 curve_data->points_per_channel + 2);
> +				if (data_len - sizeof(*curve_data) < needed) {
> +					err = -EINVAL;
> +					goto err;
> +				}
>   				err = p54_convert_rev0(dev, curve_data);
>   				break;
>   			case 1:
> +				needed = curve_data->channels *
> +					(sizeof(struct pda_pa_curve_data_sample_rev1) *
> +					 curve_data->points_per_channel + 3);
> +				if (data_len - sizeof(*curve_data) < needed) {
> +					err = -EINVAL;
> +					goto err;
> +				}
>   				err = p54_convert_rev1(dev, curve_data);

please move the checks into p54_convert_rev0 / p54_convert_rev1.

Cheers,
Christian

[PATCH 2/2] wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

[Shengzhuo Wei]

The PDR_INTERFACE_LIST loop only checks that the record start is within
the entry before reading an entire struct exp_if from it. A truncated
trailing record makes the if_id/variant reads cross the entry boundary
into the heap beyond the EEPROM buffer (verified with a KASAN
reproducer of the loop). The variant also feeds the synth front-end
selection, so this is not only a leak.

Advance only while a full record still fits in the entry.

Fixes: eff1a59c48e3 ("[P54]: add mac80211-based driver for prism54 softmac hardware")
Cc: stable@vger.kernel.org
Assisted-by: GLM:5.3
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
 drivers/net/wireless/intersil/p54/eeprom.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
index 968ce9a411358e0e6b83117b1a077becc3207090..472edecf55772893afdf8be3020e6baaf80097a5 100644
--- a/drivers/net/wireless/intersil/p54/eeprom.c
+++ b/drivers/net/wireless/intersil/p54/eeprom.c
@@ -817,7 +817,8 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
 			break;
 		case PDR_INTERFACE_LIST:
 			tmp = entry->data;
-			while ((u8 *)tmp < entry->data + data_len) {
+			while ((u8 *)tmp + sizeof(struct exp_if) <=
+			       entry->data + data_len) {
 				struct exp_if *exp_if = tmp;
 				if (exp_if->if_id == cpu_to_le16(IF_ID_ISL39000))
 					synth = le16_to_cpu(exp_if->variant);

-- 
2.47.3

Re: [PATCH 2/2] wifi: p54: require a full exp_if record in PDR_INTERFACE_LIST

[Christian Lamparter]

Hi,
On 8/26/26 7:07 PM, Shengzhuo Wei wrote:
> The PDR_INTERFACE_LIST loop only checks that the record start is within
> the entry before reading an entire struct exp_if from it. A truncated
> trailing record makes the if_id/variant reads cross the entry boundary
> into the heap beyond the EEPROM buffer (verified with a KASAN
> reproducer of the loop). The variant also feeds the synth front-end
> selection, so this is not only a leak.
> 
> Advance only while a full record still fits in the entry.
> 
> Fixes: eff1a59c48e3 ("[P54]: add mac80211-based driver for prism54 softmac hardware")
> Cc: stable@vger.kernel.org
> Assisted-by: GLM:5.3
> Signed-off-by: Shengzhuo Wei <me@cherr.cc>

Hmm, sure.

Acked-by: Christian Lamparter <chunkeey@gmail.com>

> ---
>   drivers/net/wireless/intersil/p54/eeprom.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/intersil/p54/eeprom.c b/drivers/net/wireless/intersil/p54/eeprom.c
> index 968ce9a411358e0e6b83117b1a077becc3207090..472edecf55772893afdf8be3020e6baaf80097a5 100644
> --- a/drivers/net/wireless/intersil/p54/eeprom.c
> +++ b/drivers/net/wireless/intersil/p54/eeprom.c
> @@ -817,7 +817,8 @@ int p54_parse_eeprom(struct ieee80211_hw *dev, void *eeprom, int len)
>   			break;
>   		case PDR_INTERFACE_LIST:
>   			tmp = entry->data;
> -			while ((u8 *)tmp < entry->data + data_len) {
> +			while ((u8 *)tmp + sizeof(struct exp_if) <=
> +			       entry->data + data_len) {
>   				struct exp_if *exp_if = tmp;
>   				if (exp_if->if_id == cpu_to_le16(IF_ID_ISL39000))
>   					synth = le16_to_cpu(exp_if->variant);
>