nxpwifi_recv_packet_to_monif() reads the rxpd_extra_info structure right after the rxpd header when RXPD_FLAG_EXTRA_HEADER is set, but it only validates that rx_pkt_offset is at least sizeof(struct rxpd). When the descriptor reports rx_pkt_offset smaller than sizeof(struct rxpd) + sizeof(struct rxpd_extra_info) while the extra header flag is set, the memcpy() of the extra header runs past the end of the received frame and reads beyond skb->len. Reject such descriptors before copying the extra header. A single check placed next to the existing flag computation covers both the regular and the HE copy sites. This was found by static analysis and confirmed with a KASAN reproducer; in the real driver path the over-read stays inside the skb headroom/tailroom slack, so it is a defensive fix rather than a memory corruption issue. Signed-off-by: Heyang Tan --- drivers/net/wireless/nxp/nxpwifi/util.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/nxp/nxpwifi/util.c b/drivers/net/wireless/nxp/nxpwifi/util.c index ae8444a14..bc85846d5 100644 --- a/drivers/net/wireless/nxp/nxpwifi/util.c +++ b/drivers/net/wireless/nxp/nxpwifi/util.c @@ -616,6 +616,10 @@ int nxpwifi_recv_packet_to_monif(struct nxpwifi_private *priv, has_ext = rxpd->flags & RXPD_FLAG_EXTRA_HEADER; + if (has_ext && + rx_pkt_offset < sizeof(struct rxpd) + sizeof(struct rxpd_extra_info)) + return -EINVAL; + if (has_ext) memcpy((void *)&ext, (void *)(rxpd + 1), sizeof(ext));