Brian Norris <briannorris@xxxxxxxxxxxx> wrote: > mwifiex records information about various channels as it receives scan > information. It does this by appending to a buffer that was sized > to the max number of supported channels on any band, but there are > numerous problems: > > (a) scans can return info from more than one band (e.g., both 2.4 and 5 > GHz), so the determined "max" is not large enough > (b) some firmware appears to return multiple results for a given > channel, so the max *really* isn't large enough > (c) there is no bounds checking when stashing these stats, so problems > (a) and (b) can easily lead to buffer overflows > > Let's patch this by setting a slightly-more-correct max (that accounts > for a combination of both 2.4G and 5G bands) and adding a bounds check > when writing to our statistics buffer. > > Due to problem (b), we still might not properly report all known survey > information (e.g., with "iw <dev> survey dump"), since duplicate results > (or otherwise "larger than expected" results) will cause some > truncation. But that's a problem for a future bugfix. > > (And because of this known deficiency, only log the excess at the WARN > level, since that isn't visible by default in this driver and would > otherwise be a bit too noisy.) > > Fixes: bf35443314ac ("mwifiex: channel statistics support for mwifiex") > Cc: <stable@xxxxxxxxxxxxxxx> > Cc: Avinash Patil <patila@xxxxxxxxxxx> > Cc: Xinming Hu <huxm@xxxxxxxxxxx> > Signed-off-by: Brian Norris <briannorris@xxxxxxxxxxxx> > Reviewed-by: Dmitry Torokhov <dmitry.torokhov@xxxxxxxxx> > Reviewed-by: Ganapathi Bhat <gbhat@xxxxxxxxxxx> Patch applied to wireless-drivers-next.git, thanks. 4b5dde2d6234 mwifiex: correct channel stat buffer overflows -- https://patchwork.kernel.org/patch/9818269/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches