mm81x_yaps_hw_read_pkts() reads a full 4-byte delimiter and then subtracts sizeof(delim) from bytes_remaining on every loop iteration, guarded only by "bytes_remaining > 0". If 1-3 bytes are left in the window, this reads past the end of the valid data and then subtracts 4 from a value smaller than 4, driving bytes_remaining negative. A negative bytes_remaining then reaches the total_len > bytes_remaining branch, where "bytes_remaining" is passed to memcpy() as the copy length. Implicitly converted to size_t, a negative int becomes a huge value, turning that memcpy() into a massive out-of-bounds copy. Bail out of the split loop once fewer than sizeof(delim) bytes remain, the same way the existing "end of stream" check bails on a zero delimiter. Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver") Signed-off-by: Muhammad Bilal --- drivers/net/wireless/morsemicro/mm81x/yaps_hw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c b/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c index 3d641d23c35b..e1102b8fb802 100644 --- a/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c +++ b/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c @@ -486,6 +486,9 @@ static int mm81x_yaps_hw_read_pkts(struct mm81x_yaps *yaps, int total_len; int pkt_size; + if (bytes_remaining < (int)sizeof(delim)) + break; + delim = le32_to_cpu(*((__le32 *)read_ptr)); read_ptr += sizeof(delim); bytes_remaining -= sizeof(delim); -- 2.55.0