wifi: libertas: fix RX OOB access from device-controlled pkt_ptr

Browse source

lbs_process_rxed_packet() computes the packet header pointer as
skb->data + rxpd->pkt_ptr, where pkt_ptr is a 32-bit value supplied
by the device, and never checks it against the packet length. The
only validation (skb->len < ETH_HLEN + 8 + sizeof(struct rxpd))
bounds the total length, not pkt_ptr.

A bogus device can report an arbitrary pkt_ptr:

- the memcmp() against the RFC1042 header reads 6 bytes at
  pkt_ptr + 14, potentially past the skb buffer
- if the compared bytes happen to match, the EthernetII header
  reconstruction writes 12 bytes at pkt_ptr + 8;
- hdrchop derived from pkt_ptr is later passed to skb_pull().

Validate pkt_ptr before using it: it must leave room for a full
struct rxpackethdr within the received frame. It is not expected
to affect the driver behavior in most cases, only invalid pkt_ptr
packets being dropped.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

Assisted-by: LLM
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Link: https://patch.msgid.link/f22d4f23e5e54b1debd6038b3b75119f97920a73@linux.dev
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

...

This commit is contained in:

Tianchu Chen 2026-09-24 10:19:43 +00:00 • committed by Johannes Berg

parent 2cee035644

commit 076e00b142

1 changed files with 9 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

9

drivers/net/wireless/marvell/libertas/rx.c

View file