[PATCH v3 2/2] wifi: libertas: fix OOB read from firmware bssdescriptsize in scan response

Tristan Madani
2026-04-21T13:50:32Z

From: Tristan Madani <tristan@talencesecurity.com>

The firmware-controlled bssdescriptsize field in lbs_ret_scan() is used
to compute the TSF descriptor position without validation against the
response buffer size. An inflated value causes out-of-bounds reads from
the 2312-byte response buffer into adjacent struct lbs_private members.

Add a check that bssdescriptsize fits within the response data.

Fixes: ff9fc791940f ("libertas: first stab at cfg80211 support")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v3:
- Regenerated from wireless-next with proper git format-patch to
produce valid index hashes (v2 had post-processed index lines).

Changes in v2:
- No code changes from v1.

drivers/net/wireless/marvell/libertas/cfg.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
index 72c92f72469de..41dee6e0ca9fa 100644
--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c
@@ -554,6 +554,14 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,

bsssize = get_unaligned_le16(&scanresp->bssdescriptsize);

+ if (bsssize > le16_to_cpu(resp->size) -
+ sizeof(struct cmd_ds_802_11_scan_rsp)) {
+ lbs_deb_scan(
+ "scan response: bssdescriptsize %d exceeds response\n",
+ bsssize);
+ goto done;
+ }
+
lbs_deb_scan("scan response: %d BSSs (%d bytes); resp size %d bytes\n",
scanresp->nr_sets, bsssize, le16_to_cpu(resp->size));

--
2.47.3