wifi: wlcore/wl18xx: firmware trust boundary hardening

[PATCH v3 0/3] wifi: wlcore/wl18xx: firmware trust boundary hardening

Tristan Madani posted 3 patches 1 month, 3 weeks ago

Download series mbox

drivers/net/wireless/ti/wl18xx/event.c | 9 +++++++++
drivers/net/wireless/ti/wlcore/event.c | 7 +++++++
2 files changed, 16 insertions(+)

Expand all Fold all

[PATCH v3 0/3] wifi: wlcore/wl18xx: firmware trust boundary hardening

Posted by Tristan Madani 1 month, 3 weeks ago

From: Tristan Madani <tristan@talencesecurity.com>

This series adds missing bounds checks for firmware-controlled fields
in the TI wlcore and wl18xx drivers.

Patches cover: BA event link_id, logger max_buff_size, and smart config
SSID/password lengths.

Changes in v3:
  - Regenerated from wireless-next with proper git format-patch.

Changes in v2:
  - No code changes from v1.

Tristan Madani (3):
  wifi: wl18xx: fix OOB read from firmware rx_ba_link_id in BA event
    handler
  wifi: wlcore: fix OOB read from firmware max_buff_size in logger
    handler
  wifi: wl18xx: fix OOB read from firmware SSID/password lengths in
    smart config event

 drivers/net/wireless/ti/wl18xx/event.c | 9 +++++++++
 drivers/net/wireless/ti/wlcore/event.c | 7 +++++++
 2 files changed, 16 insertions(+)

-- 
2.47.3