nxpwifi_download_vdll_block() copies block_len bytes into ctrl->skb, a single NXPWIFI_SIZE_OF_CMD_BUFFER byte buffer allocated once at init time. block_len comes from the VDLL indication event and is clamped only against the length of the VDLL image, which is taken from the firmware file and is far larger than the command buffer. Two things go wrong once a block exceeds it. msg_len is a u16, so a block_len near 65535 wraps it to a small value: skb_put_zero() then reserves a few bytes while the memcpy() below still writes block_len bytes past the end of the buffer. Without the wrap, skb_put_zero() itself runs past the tail of the skb and panics. Reject a block that does not fit before the skb is touched. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Signed-off-by: Linmao Li --- drivers/net/wireless/nxp/nxpwifi/util.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/nxp/nxpwifi/util.c b/drivers/net/wireless/nxp/nxpwifi/util.c index 549661ca049a0..97811ee25f392 100644 --- a/drivers/net/wireless/nxp/nxpwifi/util.c +++ b/drivers/net/wireless/nxp/nxpwifi/util.c @@ -1228,6 +1228,12 @@ int nxpwifi_download_vdll_block(struct nxpwifi_adapter *adapter, u16 msg_len = block_len + S_DS_GEN; int ret = 0; + if (block_len > NXPWIFI_SIZE_OF_CMD_BUFFER - S_DS_GEN) { + nxpwifi_dbg(adapter, ERROR, + "VDLL block does not fit: len: %d\n", block_len); + return -EINVAL; + } + skb_trim(ctrl->skb, 0); skb_put_zero(ctrl->skb, msg_len); -- 2.25.1