From: Tristan Madani lbs_process_rxed_packet() uses the firmware-supplied pkt_ptr as an offset into the skb data without validating that it falls within the skb buffer bounds. A malicious pkt_ptr value causes out-of-bounds memory access when the function subsequently reads ethernet header fields from p_rx_pkt. Add a bounds check to ensure pkt_ptr plus the minimum packet header size does not exceed skb->len. Fixes: e45d8e534b67 ("libertas: add support for Marvell SD8688 chip") Signed-off-by: Tristan Madani --- Changes in v3: - Regenerated from wireless-next with proper git format-patch to produce valid index hashes (v2 had post-processed index lines). Changes in v2: - No code changes from v1. drivers/net/wireless/marvell/libertas/rx.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/net/wireless/marvell/libertas/rx.c b/drivers/net/wireless/marvell/libertas/rx.c index c34d30f7cbe03..3497595a67595 100644 --- a/drivers/net/wireless/marvell/libertas/rx.c +++ b/drivers/net/wireless/marvell/libertas/rx.c @@ -73,6 +73,15 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb) } p_rx_pd = (struct rxpd *) skb->data; + + if (le32_to_cpu(p_rx_pd->pkt_ptr) + sizeof(struct rxpackethdr) > + skb->len) { + lbs_deb_rx("rx err: pkt_ptr %u beyond skb len %u\n", + le32_to_cpu(p_rx_pd->pkt_ptr), skb->len); + ret = -EINVAL; + dev_kfree_skb(skb); + goto done; + } p_rx_pkt = (struct rxpackethdr *) ((u8 *)p_rx_pd + le32_to_cpu(p_rx_pd->pkt_ptr)); -- 2.47.3