From: Tristan Madani The firmware-controlled offset field in rsi_read_pkt() is validated only when rcv_pkt_len is zero (USB path). For the SDIO path, rcv_pkt_len is always positive, so the check is skipped entirely. A crafted offset can cause out-of-bounds reads past the 8192-byte pktbuffer when computing queue number, length, extended descriptor, and data pointers. Add a transport-independent bounds check to reject offset values that exceed the frame's actual_length. Fixes: dad0d04fa7ba ("rsi: data and management rx path") Signed-off-by: Tristan Madani --- drivers/net/wireless/rsi/rsi_91x_main.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/wireless/rsi/rsi_91x_main.c b/drivers/net/wireless/rsi/rsi_91x_main.c index XXXXXXX..XXXXXXX 100644 --- a/drivers/net/wireless/rsi/rsi_91x_main.c +++ b/drivers/net/wireless/rsi/rsi_91x_main.c @@ -171,6 +171,11 @@ int rsi_read_pkt(struct rsi_common *common, u8 *rx_pkt, s32 rcv_pkt_len) if (!rcv_pkt_len && offset > RSI_MAX_RX_USB_PKT_SIZE - FRAME_DESC_SZ) goto fail; + if (offset > actual_length) { + rsi_dbg(ERR_ZONE, + "%s: offset %u exceeds length %u\n", + __func__, offset, actual_length); + goto fail; + } queueno = rsi_get_queueno(frame_desc, offset); length = rsi_get_length(frame_desc, offset);