[v2] wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

[PATCH v2 next] wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

Posted by Dan Carpenter 6 months, 3 weeks ago

The "link_id" value comes from the user via debugfs.  If it's larger
than BITS_PER_LONG then that would result in shift wrapping and
potentially an out of bounds access later.  In fact, we can limit it
to IEEE80211_MLD_MAX_NUM_LINKS (15).

Fortunately, only root can write to debugfs files so the security
impact is minimal.

Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG.
It's stricter and also more informative.

 drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/realtek/rtw89/core.c b/drivers/net/wireless/realtek/rtw89/core.c
index 49447668cbf3..3604a8e15df0 100644
--- a/drivers/net/wireless/realtek/rtw89/core.c
+++ b/drivers/net/wireless/realtek/rtw89/core.c
@@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct rtw89_vif *rtwvif,
 	if (unlikely(!ieee80211_vif_is_mld(vif)))
 		return -EOPNOTSUPP;
 
-	if (unlikely(!(usable_links & BIT(link_id)))) {
+	if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS ||
+		     !(usable_links & BIT(link_id)))) {
 		rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__,
 			   link_id);
 		return -ENOLINK;
-- 
2.47.2

Re: [PATCH v2 next] wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

Posted by Ping-Ke Shih 6 months, 1 week ago

Dan Carpenter <dan.carpenter@linaro.org> wrote:

> The "link_id" value comes from the user via debugfs.  If it's larger
> than BITS_PER_LONG then that would result in shift wrapping and
> potentially an out of bounds access later.  In fact, we can limit it
> to IEEE80211_MLD_MAX_NUM_LINKS (15).
> 
> Fortunately, only root can write to debugfs files so the security
> impact is minimal.
> 
> Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> Reviewed-by: Zong-Zhe Yang <kevin_yang@realtek.com>

1 patch(es) applied to rtw-next branch of rtw.git, thanks.

53cf488927a0 wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

---
https://github.com/pkshih/rtw.git

RE: [PATCH v2 next] wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

Posted by Zong-Zhe Yang 6 months, 2 weeks ago

Dan Carpenter <dan.carpenter@linaro.org> wrote:
> 
> The "link_id" value comes from the user via debugfs.  If it's larger than BITS_PER_LONG then
> that would result in shift wrapping and potentially an out of bounds access later.  In fact, we
> can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15).
> 
> Fortunately, only root can write to debugfs files so the security impact is minimal.
> 
> Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG.
> It's stricter and also more informative.
> 
>  drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtw89/core.c
> b/drivers/net/wireless/realtek/rtw89/core.c
> index 49447668cbf3..3604a8e15df0 100644
> --- a/drivers/net/wireless/realtek/rtw89/core.c
> +++ b/drivers/net/wireless/realtek/rtw89/core.c
> @@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct
> rtw89_vif *rtwvif,
>         if (unlikely(!ieee80211_vif_is_mld(vif)))
>                 return -EOPNOTSUPP;
> 
> -       if (unlikely(!(usable_links & BIT(link_id)))) {
> +       if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS ||
> +                    !(usable_links & BIT(link_id)))) {
>                 rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__,
>                            link_id);
>                 return -ENOLINK;
> --
> 2.47.2

It looks good to me.
Thank you.

RE: [PATCH v2 next] wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch()

Posted by Ping-Ke Shih 6 months, 2 weeks ago

Zong-Zhe Yang <kevin_yang@realtek.com> wrote:
> Dan Carpenter <dan.carpenter@linaro.org> wrote:
> >
> > The "link_id" value comes from the user via debugfs.  If it's larger than BITS_PER_LONG then
> > that would result in shift wrapping and potentially an out of bounds access later.  In fact, we
> > can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15).
> >
> > Fortunately, only root can write to debugfs files so the security impact is minimal.
> >
> > Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs")
> > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> > ---
> > Use IEEE80211_MLD_MAX_NUM_LINKS as a limit instead of BITS_PER_LONG.
> > It's stricter and also more informative.
> >
> >  drivers/net/wireless/realtek/rtw89/core.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/wireless/realtek/rtw89/core.c
> > b/drivers/net/wireless/realtek/rtw89/core.c
> > index 49447668cbf3..3604a8e15df0 100644
> > --- a/drivers/net/wireless/realtek/rtw89/core.c
> > +++ b/drivers/net/wireless/realtek/rtw89/core.c
> > @@ -5239,7 +5239,8 @@ int rtw89_core_mlsr_switch(struct rtw89_dev *rtwdev, struct
> > rtw89_vif *rtwvif,
> >         if (unlikely(!ieee80211_vif_is_mld(vif)))
> >                 return -EOPNOTSUPP;
> >
> > -       if (unlikely(!(usable_links & BIT(link_id)))) {
> > +       if (unlikely(link_id >= IEEE80211_MLD_MAX_NUM_LINKS ||
> > +                    !(usable_links & BIT(link_id)))) {
> >                 rtw89_warn(rtwdev, "%s: link id %u is not usable\n", __func__,
> >                            link_id);
> >                 return -ENOLINK;
> > --
> > 2.47.2
> 
> It looks good to me.
> Thank you.

I will add a tag during committing. 

Reviewed-by: Zong-Zhe Yang <kevin_yang@realtek.com>