From: Tristan Madani The firmware-controlled bssdescriptsize field in lbs_ret_scan() is used to compute the TSF descriptor position without validation against the response buffer size. An inflated value causes out-of-bounds reads from the 2312-byte response buffer into adjacent struct lbs_private members. Add a check that bssdescriptsize fits within the response data. Fixes: ff9fc791940f ("libertas: first stab at cfg80211 support") Signed-off-by: Tristan Madani --- drivers/net/wireless/marvell/libertas/cfg.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c index XXXXXXX..XXXXXXX 100644 --- a/drivers/net/wireless/marvell/libertas/cfg.c +++ b/drivers/net/wireless/marvell/libertas/cfg.c @@ -555,6 +555,14 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy, bsssize = get_unaligned_le16(&scanresp->bssdescriptsize); + if (bsssize > le16_to_cpu(resp->size) - + sizeof(struct cmd_ds_802_11_scan_rsp)) { + lbs_deb_scan( + "scan response: bssdescriptsize %d exceeds response\n", + bsssize); + goto done; + } + lbs_deb_scan("scan response: %d BSSs (%d bytes); resp size %d bytes\n", scanresp->nr_sets, bsssize, le16_to_cpu(resp->size));