wifi: mwifiex: bound SDIO fw dump count by memory table size

Browse source

mwifiex_sdio_fw_dump() reads the number of memory regions (dump_num)
from a device register and uses it to index the static 15-entry
mem_type_mapping_tbl[] without any bounds check.  A bogus device can
report a dump_num larger than the table; each out-of-table loop
iteration then reads entry->mem_name and entry->done_flag and stores
a vmalloc pointer and a device-controlled size past the end of the
table, into adjacent .data (up to ~5.6KiB when dump_num is 255).

The dump path runs after command timeouts or firmware crashes, so a
bogus device can first force an error to trigger the dump and then
report a bogus dump_num.

Limit dump_num to the table size instead of aborting the dump. This
is not expected to change the behavior on normal devices.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

Assisted-by: LLM
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Acked-by: Brian Norris <briannorris@chromium.org>
Link: https://patch.msgid.link/33a45fd59b5569cbce79142d2e012e191989ec26@linux.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

...

This commit is contained in:

Tianchu Chen 2026-09-23 14:43:51 +00:00 • committed by Johannes Berg

parent 1359b631c7

commit dbca9dfd3b

1 changed files with 3 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

drivers/net/wireless/marvell/mwifiex/sdio.c

View file