wifi: ath6kl: firmware trust boundary hardening

[PATCH v3 0/3] wifi: ath6kl: firmware trust boundary hardening

Tristan Madani posted 3 patches 1 month, 3 weeks ago

Download series mbox

drivers/net/wireless/ath/ath6kl/txrx.c |  4 +++-
drivers/net/wireless/ath/ath6kl/wmi.c  | 14 ++++++++++++++
2 files changed, 17 insertions(+), 1 deletion(-)

Expand all Fold all

[PATCH v3 0/3] wifi: ath6kl: firmware trust boundary hardening

Posted by Tristan Madani 1 month, 3 weeks ago

From: Tristan Madani <tristan@talencesecurity.com>

This series adds missing bounds checks for firmware-controlled fields
in the Qualcomm ath6kl driver.

Patch 1 returns early on invalid ADDBA window size. Patch 2 validates
connect event IE lengths. Patch 3 checks TX complete handler num_msg.

Changes in v3:
  - Regenerated from wireless-next with proper git format-patch.

Changes in v2:
  - No code changes from v1.

Tristan Madani (3):
  wifi: ath6kl: fix OOB access from firmware ADDBA window size
  wifi: ath6kl: fix OOB read from firmware IE lengths in connect event
  wifi: ath6kl: fix OOB read from firmware num_msg in TX complete
    handler

 drivers/net/wireless/ath/ath6kl/txrx.c |  4 +++-
 drivers/net/wireless/ath/ath6kl/wmi.c  | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

-- 
2.47.3