rtw_sdio_rxfifo_recv() also takes the last-entry path when the descriptor claims more data than rx_len. The skb is then passed to rtw_sdio_rx_skb(), which calls skb_put() with pkt_len and does not check it against the space left, so a bad descriptor can overflow the skb. Reject the packet when pkt_offset + pkt_len exceeds the bytes left. Fixes: 65371a3f14e7 ("wifi: rtw88: sdio: Add HCI implementation for SDIO based chipsets") Cc: stable@vger.kernel.org Signed-off-by: Luka Gejak --- drivers/net/wireless/realtek/rtw88/sdio.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/net/wireless/realtek/rtw88/sdio.c b/drivers/net/wireless/realtek/rtw88/sdio.c index dc2fd0f8f9ff..3a86fdcde367 100644 --- a/drivers/net/wireless/realtek/rtw88/sdio.c +++ b/drivers/net/wireless/realtek/rtw88/sdio.c @@ -1389,6 +1389,14 @@ static void rtw_sdio_rxfifo_recv(struct rtw_dev *rtwdev, u32 rx_len) curr_pkt_len = ALIGN(pkt_offset + pkt_stat.pkt_len, RTW_SDIO_DATA_PTR_ALIGN); + if (unlikely(pkt_offset + pkt_stat.pkt_len > rx_len)) { + rtw_dbg(rtwdev, RTW_DBG_SDIO, + "oversized RX packet: %u, %u bytes left\n", + pkt_offset + pkt_stat.pkt_len, rx_len); + dev_kfree_skb_any(skb); + return; + } + if ((curr_pkt_len + pkt_desc_sz) >= rx_len) { /* Use the original skb (with it's adjusted offset) * when processing the last (or even the only) entry to -- 2.55.0