7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: Laxman Acharya Padhya [ Upstream commit 273b0a8be083df6d0319ce62caa870e927f94a31 ] rtw89_fw_bin_info.section_info has FWDL_SECTION_MAX_NUM (10) entries. The v0/v1 header parsers take section_num from an 8-bit firmware field (0..255) and write info->section_info[i] with no cap. rtw89_fw_download_suit() keeps that object on the stack, so a crafted firmware blob overflows the stack. Reject a truncated header and a section table that does not fit in the firmware image before reading fw_hdr->sections[i]. Fixes: e3ec7017f6a2 ("rtw89: add Realtek 802.11ax driver") Cc: stable@vger.kernel.org Acked-by: Ping-Ke Shih Signed-off-by: Laxman Acharya Padhya Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20260825174438.63168-1-acharyalaxman8848@gmail.com Signed-off-by: Sasha Levin --- drivers/net/wireless/realtek/rtw89/fw.c | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw89/fw.c b/drivers/net/wireless/realtek/rtw89/fw.c index 0099c5c03e7a6..b2991bc93f852 100644 --- a/drivers/net/wireless/realtek/rtw89/fw.c +++ b/drivers/net/wireless/realtek/rtw89/fw.c @@ -156,8 +156,24 @@ static int rtw89_fw_hdr_parser_v0(struct rtw89_dev *rtwdev, const u8 *fw, u32 le if (!info) return -EINVAL; + if (len < sizeof(*fw_hdr)) { + rtw89_err(rtwdev, "[ERR]fw header truncated\n"); + return -EINVAL; + } + info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_W6_SEC_NUM); + if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) { + rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n", + info->section_num); + return -EINVAL; + } + base_hdr_len = struct_size(fw_hdr, sections, info->section_num); + if (base_hdr_len > len) { + rtw89_err(rtwdev, "[ERR]fw header truncated\n"); + return -EINVAL; + } + info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_W7_DYN_HDR); info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_W7_IDMEM_SHARE_MODE); @@ -455,9 +471,25 @@ static int rtw89_fw_hdr_parser_v1(struct rtw89_dev *rtwdev, const u8 *fw, u32 le int ret; u32 i; + if (len < sizeof(*fw_hdr)) { + rtw89_err(rtwdev, "[ERR]fw header truncated\n"); + return -EINVAL; + } + info->section_num = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_SEC_NUM); + if (!info->section_num || info->section_num > FWDL_SECTION_MAX_NUM) { + rtw89_err(rtwdev, "[ERR]invalid fw section num %u\n", + info->section_num); + return -EINVAL; + } + info->dsp_checksum = le32_get_bits(fw_hdr->w6, FW_HDR_V1_W6_DSP_CHKSUM); base_hdr_len = struct_size(fw_hdr, sections, info->section_num); + if (base_hdr_len > len) { + rtw89_err(rtwdev, "[ERR]fw header truncated\n"); + return -EINVAL; + } + info->dynamic_hdr_en = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_DYN_HDR); info->idmem_share_mode = le32_get_bits(fw_hdr->w7, FW_HDR_V1_W7_IDMEM_SHARE_MODE); -- 2.53.0