From: Tristan Madani The TSF and ChanBand TLV arrays are indexed by the firmware-controlled number_of_sets without cross-checking against the TLV header length fields. When number_of_sets exceeds the TLV data, the loop reads past the TLV data into adjacent command response memory. Stop using the TLV data once the index exceeds its reported length. Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") Signed-off-by: Tristan Madani --- drivers/net/wireless/marvell/mwifiex/scan.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c index XXXXXXX..XXXXXXX 100644 --- a/drivers/net/wireless/marvell/mwifiex/scan.c +++ b/drivers/net/wireless/marvell/mwifiex/scan.c @@ -2188,10 +2188,12 @@ static int mwifiex_ret_802_11_scan(struct mwifiex_private *priv, * received. */ if (tsf_tlv) - memcpy(&fw_tsf, &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE], + if ((idx + 1) * TSF_DATA_SIZE <= + le16_to_cpu(tsf_tlv->header.len)) + memcpy(&fw_tsf, &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE], sizeof(fw_tsf)); - if (chan_band_tlv) { + if (chan_band_tlv && (idx + 1) * sizeof(*chan_band) <= + le16_to_cpu(chan_band_tlv->header.len)) { chan_band = &chan_band_tlv->chan_band_param[idx]; radio_type = &chan_band->radio_type; } else {