The scan response handler indexes into TSF and channel-band TLV arrays using a loop counter derived from the number of BSS entries, but never checks whether the TLV data is large enough. A firmware response with fewer TLV entries than BSS entries leads to reads past the TLV buffer. Add bounds checks that verify each indexed access falls within the TLV's declared length before dereferencing. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- Changes in v2: - Fix From:/Signed-off-by: email mismatch. - Add missing Cc: recipients (Francesco Dolcini). - No code changes. drivers/net/wireless/nxp/nxpwifi/scan.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/nxp/nxpwifi/scan.c b/drivers/net/wireless/nxp/nxpwifi/scan.c index 67d7ff2f10c59..a8d3387320af4 100644 --- a/drivers/net/wireless/nxp/nxpwifi/scan.c +++ b/drivers/net/wireless/nxp/nxpwifi/scan.c @@ -1999,12 +1999,22 @@ int nxpwifi_ret_802_11_scan(struct nxpwifi_private *priv, * was received. */ if (tsf_tlv) - memcpy(&fw_tsf, &tsf_tlv->tsf_data[idx * TSF_DATA_SIZE], - sizeof(fw_tsf)); + if ((idx + 1) * TSF_DATA_SIZE <= + le16_to_cpu(tsf_tlv->header.len)) + memcpy(&fw_tsf, + &tsf_tlv->tsf_data[idx * + TSF_DATA_SIZE], + sizeof(fw_tsf)); if (chan_band_tlv) { - chan_band = &chan_band_tlv->chan_band_param[idx]; - radio_type = &chan_band->radio_type; + if ((idx + 1) * sizeof(*chan_band) <= + le16_to_cpu(chan_band_tlv->header.len)) { + chan_band = + &chan_band_tlv->chan_band_param[idx]; + radio_type = &chan_band->radio_type; + } else { + radio_type = NULL; + } } else { radio_type = NULL; } -- 2.47.3