In mm81x_cmd_resp_process(), the memcpy length is bounded by the caller's expected length and the firmware-reported response length, but not by the actual data available in the skb. A malformed device response where the inner header's len field exceeds the YAPS payload would cause the memcpy to read past valid skb data. Add a min_t() bound against skb->len so the copy never exceeds the data actually present in the buffer. Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver") Signed-off-by: Aamir Ahmed --- drivers/net/wireless/morsemicro/mm81x/command.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/morsemicro/mm81x/command.c b/drivers/net/wireless/morsemicro/mm81x/command.c index afb7ee9bb236..591e5ba10753 100644 --- a/drivers/net/wireless/morsemicro/mm81x/command.c +++ b/drivers/net/wireless/morsemicro/mm81x/command.c @@ -209,6 +209,7 @@ int mm81x_cmd_resp_process(struct mm81x *mors, struct sk_buff *skb) length = min_t(int, length, le16_to_cpu(src_resp->hdr.len) + sizeof(struct host_cmd_header)); + length = min_t(int, length, skb->len); memcpy(dest_resp, src_resp, length); } else { ret = le32_to_cpu(src_resp->status); -- 2.43.0