[PATCH v3 0/2] wifi: libertas: firmware trust boundary hardening

[PATCH v3 0/2] wifi: libertas: firmware trust boundary hardening

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

This series adds missing bounds checks for firmware-controlled fields
in the Marvell libertas driver.

Patch 1 validates pkt_ptr offset in the RX path. Patch 2 checks
bssdescriptsize in scan responses.

Changes in v3:
  - Regenerated from wireless-next with proper git format-patch.

Changes in v2:
  - No code changes from v1.

Tristan Madani (2):
  wifi: libertas: fix OOB read from firmware pkt_ptr offset in RX path
  wifi: libertas: fix OOB read from firmware bssdescriptsize in scan
    response

 drivers/net/wireless/marvell/libertas/cfg.c | 8 ++++++++
 drivers/net/wireless/marvell/libertas/rx.c  | 9 +++++++++
 2 files changed, 17 insertions(+)

-- 
2.47.3

[PATCH v3 1/2] wifi: libertas: fix OOB read from firmware pkt_ptr offset in RX path

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

lbs_process_rxed_packet() uses the firmware-supplied pkt_ptr as an
offset into the skb data without validating that it falls within the
skb buffer bounds. A malicious pkt_ptr value causes out-of-bounds
memory access when the function subsequently reads ethernet header
fields from p_rx_pkt.

Add a bounds check to ensure pkt_ptr plus the minimum packet header
size does not exceed skb->len.

Fixes: e45d8e534b67 ("libertas: add support for Marvell SD8688 chip")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v3:
  - Regenerated from wireless-next with proper git format-patch to
    produce valid index hashes (v2 had post-processed index lines).

Changes in v2:
  - No code changes from v1.

 drivers/net/wireless/marvell/libertas/rx.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/marvell/libertas/rx.c b/drivers/net/wireless/marvell/libertas/rx.c
index c34d30f7cbe03..3497595a67595 100644
--- a/drivers/net/wireless/marvell/libertas/rx.c
+++ b/drivers/net/wireless/marvell/libertas/rx.c
@@ -73,6 +73,15 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
 	}
 
 	p_rx_pd = (struct rxpd *) skb->data;
+
+	if (le32_to_cpu(p_rx_pd->pkt_ptr) + sizeof(struct rxpackethdr) >
+	    skb->len) {
+		lbs_deb_rx("rx err: pkt_ptr %u beyond skb len %u\n",
+			   le32_to_cpu(p_rx_pd->pkt_ptr), skb->len);
+		ret = -EINVAL;
+		dev_kfree_skb(skb);
+		goto done;
+	}
 	p_rx_pkt = (struct rxpackethdr *) ((u8 *)p_rx_pd +
 		le32_to_cpu(p_rx_pd->pkt_ptr));
 
-- 
2.47.3

Re: [PATCH v3 1/2] wifi: libertas: fix OOB read from firmware pkt_ptr offset in RX path

[Johannes Berg]

On Tue, 2026-04-21 at 13:50 +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> lbs_process_rxed_packet() uses the firmware-supplied pkt_ptr as an
> offset into the skb data without validating that it falls within the
> skb buffer bounds. A malicious pkt_ptr value causes out-of-bounds
> memory access when the function subsequently reads ethernet header
> fields from p_rx_pkt.
> 
> Add a bounds check to ensure pkt_ptr plus the minimum packet header
> size does not exceed skb->len.

Please generally put a bit more thought into your patches.

> Fixes: e45d8e534b67 ("libertas: add support for Marvell SD8688 chip")
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

I'll also note again that I don't find any tool/LLM disclosure
improbably, nobody really cares about these rivers any more?

>  	p_rx_pd = (struct rxpd *) skb->data;
> +
> +	if (le32_to_cpu(p_rx_pd->pkt_ptr) + sizeof(struct rxpackethdr) >
> +	    skb->len) {
> 

At this point you don't even know yet that the skb is long enough to
access p_r x_pd->pkt_ptr *itself*, so this can't be right.

There's a length check later that checks for

        if (skb->len < (ETH_HLEN + 8 + sizeof(struct rxpd))) {

which probably needs to be moved up _and_ improved, but you're not
actually checking things correctly.

How is it that whatever tool you're using to find these isn't
complaining about the fix??

johannes

[PATCH v3 2/2] wifi: libertas: fix OOB read from firmware bssdescriptsize in scan response

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

The firmware-controlled bssdescriptsize field in lbs_ret_scan() is used
to compute the TSF descriptor position without validation against the
response buffer size. An inflated value causes out-of-bounds reads from
the 2312-byte response buffer into adjacent struct lbs_private members.

Add a check that bssdescriptsize fits within the response data.

Fixes: ff9fc791940f ("libertas: first stab at cfg80211 support")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v3:
  - Regenerated from wireless-next with proper git format-patch to
    produce valid index hashes (v2 had post-processed index lines).

Changes in v2:
  - No code changes from v1.

 drivers/net/wireless/marvell/libertas/cfg.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
index 72c92f72469de..41dee6e0ca9fa 100644
--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
@@ -554,6 +554,14 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
 
 	bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);
 
+	if (bsssize > le16_to_cpu(resp->size) -
+	    sizeof(struct cmd_ds_802_11_scan_rsp)) {
+		lbs_deb_scan(
+			"scan response: bssdescriptsize %d exceeds response\n",
+			bsssize);
+		goto done;
+	}
+
 	lbs_deb_scan("scan response: %d BSSs (%d bytes); resp size %d bytes\n",
 			scanresp->nr_sets, bsssize, le16_to_cpu(resp->size));
 
-- 
2.47.3

Re: [PATCH v3 2/2] wifi: libertas: fix OOB read from firmware bssdescriptsize in scan response

[Dan Carpenter]

Hi Tristan,

kernel test robot noticed the following build warnings:

https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Tristan-Madani/wifi-libertas-fix-OOB-read-from-firmware-pkt_ptr-offset-in-RX-path/20260423-061353
base:   https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
patch link:    https://lore.kernel.org/r/20260421135027.357622-3-tristmd%40gmail.com
patch subject: [PATCH v3 2/2] wifi: libertas: fix OOB read from firmware bssdescriptsize in scan response
config: i386-randconfig-141 (https://download.01.org/0day-ci/archive/20260503/202605030019.lL8x0ZPx-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9065-ge9cc34fd

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202605030019.lL8x0ZPx-lkp@intel.com/

smatch warnings:
drivers/net/wireless/marvell/libertas/rx.c:77 lbs_process_rxed_packet() warn: potential user controlled sizeof overflow '((p_rx_pd->pkt_ptr)) + 22' '0-u32max + 22'

vim +77 drivers/net/wireless/marvell/libertas/rx.c

69f9032d9dfeb7 drivers/net/wireless/libertas/rx.c         Holger Schurig            2007-11-23   57  int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   58  {
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   59  	int ret = 0;
6f93a8e7e41c2d drivers/net/wireless/libertas/rx.c         David Woodhouse           2007-12-10   60  	struct net_device *dev = priv->dev;
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   61  	struct rxpackethdr *p_rx_pkt;
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   62  	struct rxpd *p_rx_pd;
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   63  	int hdrchop;
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   64  	struct ethhdr *p_ethhdr;
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   65  
7919b89c8276d6 drivers/net/wireless/libertas/rx.c         Holger Schurig            2008-04-01   66  	BUG_ON(!skb);
7919b89c8276d6 drivers/net/wireless/libertas/rx.c         Holger Schurig            2008-04-01   67  
6f93a8e7e41c2d drivers/net/wireless/libertas/rx.c         David Woodhouse           2007-12-10   68  	skb->ip_summed = CHECKSUM_NONE;
6f93a8e7e41c2d drivers/net/wireless/libertas/rx.c         David Woodhouse           2007-12-10   69  
d2ed2703cabd1e drivers/net/wireless/libertas/rx.c         Dan Williams              2014-05-22   70  	if (priv->wdev->iftype == NL80211_IFTYPE_MONITOR) {
d2ed2703cabd1e drivers/net/wireless/libertas/rx.c         Dan Williams              2014-05-22   71  		ret = process_rxed_802_11_packet(priv, skb);
d2ed2703cabd1e drivers/net/wireless/libertas/rx.c         Dan Williams              2014-05-22   72  		goto done;
d2ed2703cabd1e drivers/net/wireless/libertas/rx.c         Dan Williams              2014-05-22   73  	}
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   74  
e45d8e534b6758 drivers/net/wireless/libertas/rx.c         Bing Zhao                 2009-04-06   75  	p_rx_pd = (struct rxpd *) skb->data;
                                                                                                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This comes from rx network data.

695347d07c2b05 drivers/net/wireless/marvell/libertas/rx.c Tristan Madani            2026-04-21   76  
695347d07c2b05 drivers/net/wireless/marvell/libertas/rx.c Tristan Madani            2026-04-21  @77  	if (le32_to_cpu(p_rx_pd->pkt_ptr) + sizeof(struct rxpackethdr) >
                                                                                                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This + operation can have an integer wrapping bug.

695347d07c2b05 drivers/net/wireless/marvell/libertas/rx.c Tristan Madani            2026-04-21   78  	    skb->len) {
695347d07c2b05 drivers/net/wireless/marvell/libertas/rx.c Tristan Madani            2026-04-21   79  		lbs_deb_rx("rx err: pkt_ptr %u beyond skb len %u\n",
695347d07c2b05 drivers/net/wireless/marvell/libertas/rx.c Tristan Madani            2026-04-21   80  			   le32_to_cpu(p_rx_pd->pkt_ptr), skb->len);
695347d07c2b05 drivers/net/wireless/marvell/libertas/rx.c Tristan Madani            2026-04-21   81  		ret = -EINVAL;
695347d07c2b05 drivers/net/wireless/marvell/libertas/rx.c Tristan Madani            2026-04-21   82  		dev_kfree_skb(skb);
695347d07c2b05 drivers/net/wireless/marvell/libertas/rx.c Tristan Madani            2026-04-21   83  		goto done;
695347d07c2b05 drivers/net/wireless/marvell/libertas/rx.c Tristan Madani            2026-04-21   84  	}
e45d8e534b6758 drivers/net/wireless/libertas/rx.c         Bing Zhao                 2009-04-06   85  	p_rx_pkt = (struct rxpackethdr *) ((u8 *)p_rx_pd +
e45d8e534b6758 drivers/net/wireless/libertas/rx.c         Bing Zhao                 2009-04-06   86  		le32_to_cpu(p_rx_pd->pkt_ptr));
e0e42da3a4df6f drivers/net/wireless/libertas/rx.c         Holger Schurig            2009-11-25   87  
e0e42da3a4df6f drivers/net/wireless/libertas/rx.c         Holger Schurig            2009-11-25   88  	dev = lbs_mesh_set_dev(priv, dev, p_rx_pd);
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   89  
ece56191932623 drivers/net/wireless/libertas/rx.c         Holger Schurig            2007-08-02   90  	lbs_deb_hex(LBS_DEB_RX, "RX Data: Before chop rxpd", skb->data,
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   91  		 min_t(unsigned int, skb->len, 100));
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   92  
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   93  	if (skb->len < (ETH_HLEN + 8 + sizeof(struct rxpd))) {
9012b28a407511 drivers/net/wireless/libertas/rx.c         Holger Schurig            2007-05-25   94  		lbs_deb_rx("rx err: frame received with bad length\n");
bbfc6b788f63f0 drivers/net/wireless/libertas/rx.c         Stephen Hemminger         2009-03-20   95  		dev->stats.rx_length_errors++;
d2ed2703cabd1e drivers/net/wireless/libertas/rx.c         Dan Williams              2014-05-22   96  		ret = -EINVAL;
f54930f363113a drivers/net/wireless/libertas/rx.c         Philip Rakity             2009-04-07   97  		dev_kfree_skb(skb);
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   98  		goto done;
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10   99  	}
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10  100  
e45d8e534b6758 drivers/net/wireless/libertas/rx.c         Bing Zhao                 2009-04-06  101  	lbs_deb_rx("rx data: skb->len - pkt_ptr = %d-%zd = %zd\n",
a2caba6b5fc4e0 drivers/net/wireless/libertas/rx.c         John W. Linville          2009-04-14  102  		skb->len, (size_t)le32_to_cpu(p_rx_pd->pkt_ptr),
a2caba6b5fc4e0 drivers/net/wireless/libertas/rx.c         John W. Linville          2009-04-14  103  		skb->len - (size_t)le32_to_cpu(p_rx_pd->pkt_ptr));
876c9d3aeb989c drivers/net/wireless/libertas/rx.c         Marcelo Tosatti           2007-02-10  104  
ece56191932623 drivers/net/wireless/libertas/rx.c         Holger Schurig            2007-08-02  105  	lbs_deb_hex(LBS_DEB_RX, "RX Data: Dest", p_rx_pkt->eth803_hdr.dest_addr,

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [PATCH v3 2/2] wifi: libertas: fix OOB read from firmware bssdescriptsize in scan response

[Dan Carpenter]

On Sat, May 02, 2026 at 08:02:39PM +0300, Dan Carpenter wrote:
> Hi Tristan,
> 
> kernel test robot noticed the following build warnings:
> 
> https://git-scm.com/docs/git-format-patch#_base_tree_information]
> 
> url:    https://github.com/intel-lab-lkp/linux/commits/Tristan-Madani/wifi-libertas-fix-OOB-read-from-firmware-pkt_ptr-offset-in-RX-path/20260423-061353
> base:   https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
> patch link:    https://lore.kernel.org/r/20260421135027.357622-3-tristmd%40gmail.com
> patch subject: [PATCH v3 2/2] wifi: libertas: fix OOB read from firmware bssdescriptsize in scan response
> config: i386-randconfig-141 (https://download.01.org/0day-ci/archive/20260503/202605030019.lL8x0ZPx-lkp@intel.com/config)
          ^^^^^^^^^^^^^^^^^^^
Of course, it can't wrap on 64 bit systems.  But just do

	if (size_add(le32_to_cpu(p_rx_pd->pkt_ptr), sizeof(struct rxpackethdr)) > skb->len) {

I don't know if anyone uses this hardware on 32 bit systems but we may
as well do it right.

regards,
dan carpenter

Re: [PATCH v3 2/2] wifi: libertas: fix OOB read from firmware bssdescriptsize in scan response

[Tristan Madani]

Hi Dan,

Good catch, thanks. I'll send a V4 with size_add() for both
the pkt_ptr and bssdescriptsize checks.

Thanks,
Tristan