On Thu, Aug 24, 2023 at 09:06:51PM -0600, Gustavo A. R. Silva wrote:
> In a TLV encoding scheme, the Length part represents the length after
> the header containing the values for type and length. In this case,
> `tlv_len` should be:
>
> tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len
>
> Notice that the `- 1` accounts for the one-element array `bitmap`, which
> 1-byte size is already included in `sizeof(*tlv_rxba)`.
>
> So, if the above is correct, there is a double-counting of some members
> in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp`
> are calculated:
>
> 968 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
> 969 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
>
> in specific, members:
>
> drivers/net/wireless/marvell/mwifiex/fw.h:777
> 777 u8 mac[ETH_ALEN];
> 778 u8 tid;
> 779 u8 reserved;
> 780 __le16 seq_num;
> 781 __le16 bitmap_len;
>
> This is clearly wrong, and affects the subsequent decoding of data in
> `event_buf` through `tlv_rxba`:
>
> 970 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
>
> Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)`
> in the calculation of `tlv_buf_left` and `tmp`.
>
> This results in the following binary differences before/after changes:
>
> | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> | @@ -4698,11 +4698,11 @@
> | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
> | tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
> | - 1da7: lea -0x11(%rbx),%edx
> | + 1da7: lea -0x4(%rbx),%edx
> | 1daa: movzwl %bp,%eax
> | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
> | tmp = (u8 *)tlv_rxba + sizeof(tlv_rxba->header) + tlv_len;
> | - 1dad: lea 0x11(%r15,%rbp,1),%r15
> | + 1dad: lea 0x4(%r15,%rbp,1),%r15
>
> The above reflects the desired change: avoid counting 13 too many bytes;
> which is the total size of the double-counted members in
> `struct mwifiex_ie_types_rxba_sync`:
>
> $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> struct mwifiex_ie_types_rxba_sync {
> struct mwifiex_ie_types_header header; /* 0 4 */
>
> |-----------------------------------------------------------------------
> | u8 mac[6]; /* 4 6 */ |
> | u8 tid; /* 10 1 */ |
> | u8 reserved; /* 11 1 */ |
> | __le16 seq_num; /* 12 2 */ |
> | __le16 bitmap_len; /* 14 2 */ |
> | u8 bitmap[1]; /* 16 1 */ |
> |----------------------------------------------------------------------|
> | 13 bytes|
> -----------
>
> /* size: 17, cachelines: 1, members: 7 */
> /* last cacheline: 17 bytes */
> } __attribute__((__packed__));
>
> Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Gustavo A. R. Silva <gustavoars@xxxxxxxxxx>
Excellent commit log!
Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
--
Kees Cook
