The receive byte count comes from device-controlled status registers, but the packet splitter unconditionally consumes a four-byte delimiter. A count of one to three bytes therefore makes bytes_remaining negative. If the reused receive buffer contains a valid delimiter, the negative value is passed to memcpy() and converted to a near-SIZE_MAX length, corrupting kernel memory. YAPS streams are word aligned, so reject byte counts that cannot contain complete delimiters. Also reject delimiter sizes which do not leave any packet data after removing the reserved metadata page. Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver") Suggested-by: Lachlan Hodges Assisted-by: Codex:gpt-5 Signed-off-by: Felix Hoffmann --- Changes in v2: - Use YAPS_DELIM_GET_PKT_SIZE() for payload validation while retaining the encoded-size upper bound, as suggested by Lachlan Hodges. drivers/net/wireless/morsemicro/mm81x/yaps_hw.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c b/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c index 3d641d23c35b..c4bf79d3a0c1 100644 --- a/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c +++ b/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c @@ -401,16 +401,17 @@ static int mm81x_yaps_hw_write_pkts(struct mm81x_yaps *yaps, static bool mm81x_read_pkts_h_is_valid_delim(u32 delim) { u8 calc_crc = mm81x_yaps_hw_crc(delim); - int pkt_size = YAPS_DELIM_GET_PHANDLE_SIZE(delim); + int pkt_size = YAPS_DELIM_GET_PKT_SIZE(delim); int padding = YAPS_DELIM_GET_PADDING(delim); if (calc_crc != YAPS_DELIM_GET_CRC(delim)) return false; - if (pkt_size == 0) + if (pkt_size <= 0) return false; - if ((pkt_size + padding) > YAPS_MAX_PKT_SIZE_BYTES) + if ((pkt_size + YAPS_RESERVED_PAGE_SIZE + padding) > + YAPS_MAX_PKT_SIZE_BYTES) return false; /* Pkt length + padding should not require more padding */ @@ -455,6 +456,10 @@ static int mm81x_yaps_hw_read_pkts(struct mm81x_yaps *yaps, return 0; if (bytes_remaining < 0) return bytes_remaining; + if (!IS_ALIGNED(bytes_remaining, sizeof(u32))) { + dev_warn(yaps->mors->dev, "yaps truncated delimiter"); + return -EIO; + } if (bytes_remaining > YAPS_HW_WINDOW_SIZE_BYTES) { bytes_remaining = YAPS_HW_WINDOW_SIZE_BYTES; -- 2.43.0