From 076e00b142a25c689862a2443bad0d1229268eca Mon Sep 17 00:00:00 2001 From: Tianchu Chen Date: Thu, 24 Sep 2026 10:19:43 +0000 Subject: [PATCH] wifi: libertas: fix RX OOB access from device-controlled pkt_ptr lbs_process_rxed_packet() computes the packet header pointer as skb->data + rxpd->pkt_ptr, where pkt_ptr is a 32-bit value supplied by the device, and never checks it against the packet length. The only validation (skb->len < ETH_HLEN + 8 + sizeof(struct rxpd)) bounds the total length, not pkt_ptr. A bogus device can report an arbitrary pkt_ptr: - the memcmp() against the RFC1042 header reads 6 bytes at pkt_ptr + 14, potentially past the skb buffer - if the compared bytes happen to match, the EthernetII header reconstruction writes 12 bytes at pkt_ptr + 8; - hdrchop derived from pkt_ptr is later passed to skb_pull(). Validate pkt_ptr before using it: it must leave room for a full struct rxpackethdr within the received frame. It is not expected to affect the driver behavior in most cases, only invalid pkt_ptr packets being dropped. Discovered by Atuin - Automated Vulnerability Discovery Engine. Assisted-by: LLM Signed-off-by: Tianchu Chen Link: https://patch.msgid.link/f22d4f23e5e54b1debd6038b3b75119f97920a73@linux.dev Signed-off-by: Johannes Berg --- drivers/net/wireless/marvell/libertas/rx.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/wireless/marvell/libertas/rx.c b/drivers/net/wireless/marvell/libertas/rx.c index c34d30f7cbe0..a9d1320d90b1 100644 --- a/drivers/net/wireless/marvell/libertas/rx.c +++ b/drivers/net/wireless/marvell/libertas/rx.c @@ -89,6 +89,15 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb) goto done; } + if (le32_to_cpu(p_rx_pd->pkt_ptr) > + skb->len - sizeof(struct rxpackethdr)) { + lbs_deb_rx("rx err: pkt_ptr beyond packet\n"); + dev->stats.rx_length_errors++; + ret = -EINVAL; + dev_kfree_skb(skb); + goto done; + } + lbs_deb_rx("rx data: skb->len - pkt_ptr = %d-%zd = %zd\n", skb->len, (size_t)le32_to_cpu(p_rx_pd->pkt_ptr), skb->len - (size_t)le32_to_cpu(p_rx_pd->pkt_ptr));