wifi: wilc1000: avoid buffer overflow in WID string configuration

Fix the following copy overflow warning identified by Smatch checker.

 drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame()
        error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)

This patch introduces size check before accessing the memory buffer.
The checks are base on the WID type of received data from the firmware.
For WID string configuration, the size limit is determined by individual
element size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field
of 'struct wilc_cfg_str'.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/linux-wireless/aLFbr9Yu9j_TQTey@stanley.mountain
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Link: https://patch.msgid.link/20250829225829.5423-1-ajay.kathat@microchip.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/microchip/wilc1000/wlan_cfg.c b/drivers/net/wireless/microchip/wilc1000/wlan_cfg.c
index 131388886acbfa6af83b9a208b18596ab45e7d0b..cfabd5aebb5400dfdaad619b323b63f8c8c01741 100644 (file)
--- a/drivers/net/wireless/microchip/wilc1000/wlan_cfg.c
+++ b/drivers/net/wireless/microchip/wilc1000/wlan_cfg.c
@@ -41,10 +41,10 @@ static const struct wilc_cfg_word g_cfg_word[] = {
 };
 
 static const struct wilc_cfg_str g_cfg_str[] = {
-       {WID_FIRMWARE_VERSION, NULL},
-       {WID_MAC_ADDR, NULL},
-       {WID_ASSOC_RES_INFO, NULL},
-       {WID_NIL, NULL}
+       {WID_FIRMWARE_VERSION, 0, NULL},
+       {WID_MAC_ADDR, 0, NULL},
+       {WID_ASSOC_RES_INFO, 0, NULL},
+       {WID_NIL, 0, NULL}
 };
 
 #define WILC_RESP_MSG_TYPE_CONFIG_REPLY                'R'
@@ -147,44 +147,58 @@ static void wilc_wlan_parse_response_frame(struct wilc *wl, u8 *info, int size)
 
                switch (FIELD_GET(WILC_WID_TYPE, wid)) {
                case WID_CHAR:
+                       len = 3;
+                       if (len + 2  > size)
+                               return;
+
                        while (cfg->b[i].id != WID_NIL && cfg->b[i].id != wid)
                                i++;
 
                        if (cfg->b[i].id == wid)
                                cfg->b[i].val = info[4];
 
-                       len = 3;
                        break;
 
                case WID_SHORT:
+                       len = 4;
+                       if (len + 2  > size)
+                               return;
+
                        while (cfg->hw[i].id != WID_NIL && cfg->hw[i].id != wid)
                                i++;
 
                        if (cfg->hw[i].id == wid)
                                cfg->hw[i].val = get_unaligned_le16(&info[4]);
 
-                       len = 4;
                        break;
 
                case WID_INT:
+                       len = 6;
+                       if (len + 2  > size)
+                               return;
+
                        while (cfg->w[i].id != WID_NIL && cfg->w[i].id != wid)
                                i++;
 
                        if (cfg->w[i].id == wid)
                                cfg->w[i].val = get_unaligned_le32(&info[4]);
 
-                       len = 6;
                        break;
 
                case WID_STR:
+                       len = 2 + get_unaligned_le16(&info[2]);
+
                        while (cfg->s[i].id != WID_NIL && cfg->s[i].id != wid)
                                i++;
 
-                       if (cfg->s[i].id == wid)
+                       if (cfg->s[i].id == wid) {
+                               if (len > cfg->s[i].len || (len + 2  > size))
+                                       return;
+
                                memcpy(cfg->s[i].str, &info[2],
-                                      get_unaligned_le16(&info[2]) + 2);
+                                      len);
+                       }
 
-                       len = 2 + get_unaligned_le16(&info[2]);
                        break;
 
                default:
@@ -384,12 +398,15 @@ int wilc_wlan_cfg_init(struct wilc *wl)
        /* store the string cfg parameters */
        wl->cfg.s[i].id = WID_FIRMWARE_VERSION;
        wl->cfg.s[i].str = str_vals->firmware_version;
+       wl->cfg.s[i].len = sizeof(str_vals->firmware_version);
        i++;
        wl->cfg.s[i].id = WID_MAC_ADDR;
        wl->cfg.s[i].str = str_vals->mac_address;
+       wl->cfg.s[i].len = sizeof(str_vals->mac_address);
        i++;
        wl->cfg.s[i].id = WID_ASSOC_RES_INFO;
        wl->cfg.s[i].str = str_vals->assoc_rsp;
+       wl->cfg.s[i].len = sizeof(str_vals->assoc_rsp);
        i++;
        wl->cfg.s[i].id = WID_NIL;
        wl->cfg.s[i].str = NULL;

diff --git a/drivers/net/wireless/microchip/wilc1000/wlan_cfg.h b/drivers/net/wireless/microchip/wilc1000/wlan_cfg.h
index 7038b74f8e8ff6d1af7db3f1653ff4ed8eed05c0..5ae74bced7d7480522d9d15b87f3d50fb816777f 100644 (file)
--- a/drivers/net/wireless/microchip/wilc1000/wlan_cfg.h
+++ b/drivers/net/wireless/microchip/wilc1000/wlan_cfg.h
@@ -24,12 +24,13 @@ struct wilc_cfg_word {
 
 struct wilc_cfg_str {
        u16 id;
+       u16 len;
        u8 *str;
 };
 
 struct wilc_cfg_str_vals {
-       u8 mac_address[7];
-       u8 firmware_version[129];
+       u8 mac_address[8];
+       u8 firmware_version[130];
        u8 assoc_rsp[WILC_MAX_ASSOC_RESP_FRAME_SIZE];
 };