brcmfmac: Perform bound checking on vendor command buffer

A short or malformed vendor command buffer could cause reads outside
the command buffer.

Cc: stable@vger.kernel.org # v3.19
Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
[arend@broadcom.com: slightly modified debug trace output]
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

1 files changed, 12 insertions, 3 deletions

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
index 50cdf7090198..8eff2753abad 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
         void *dcmd_buf = NULL, *wr_pointer;
         u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
 
-        brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
-                  cmdhdr->len);
+        if (len < sizeof(*cmdhdr)) {
+                brcmf_err("vendor command too short: %d\n", len);
+                return -EINVAL;
+        }
 
         vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
         ifp = vif->ifp;
 
-        len -= sizeof(struct brcmf_vndr_dcmd_hdr);
+        brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
+
+        if (cmdhdr->offset > len) {
+                brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
+                return -EINVAL;
+        }
+
+        len -= cmdhdr->offset;
         ret_len = cmdhdr->len;
         if (ret_len > 0 || len > 0) {
                 if (len > BRCMF_DCMD_MAXLEN) {