From: Tristan Madani The firmware-controlled pad_bytes value (u8, from descriptor byte 4) is used to shift the skb_put_data() source pointer forward in rsi_mgmt_pkt_to_core(). While the existing msg_len -= pad_bytes check catches the case where pad_bytes >= msg_len, it does not prevent a large pad_bytes from shifting the read window into heap memory beyond the actual packet data. The resulting kernel heap contents are delivered to mac80211 as a management frame. Add validation that pad_bytes does not exceed half of msg_len. Alignment padding in 802.11 management frames is typically 0-3 bytes, so any value exceeding msg_len / 2 indicates a corrupted descriptor. Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver") Signed-off-by: Tristan Madani --- drivers/net/wireless/rsi/rsi_91x_mgmt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c index XXXXXXX..XXXXXXX 100644 --- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c +++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c @@ -490,6 +490,12 @@ static int rsi_mgmt_pkt_to_core(struct rsi_common *common, u8 pad_bytes = msg[4]; struct sk_buff *skb; + if (pad_bytes > msg_len / 2) { + rsi_dbg(MGMT_RX_ZONE, + "%s: pad_bytes %u too large for msg_len %d\n", + __func__, pad_bytes, msg_len); + return -EINVAL; + } if (!adapter->sc_nvifs) return -ENOLINK;