[PATCH v3 0/2] wifi: libertas: firmware trust boundary hardening

Tristan Madani
2026-04-21T13:50:30Z

From: Tristan Madani <tristan@talencesecurity.com>

This series adds missing bounds checks for firmware-controlled fields
in the Marvell libertas driver.

Patch 1 validates pkt_ptr offset in the RX path. Patch 2 checks
bssdescriptsize in scan responses.

Changes in v3:
- Regenerated from wireless-next with proper git format-patch.

Changes in v2:
- No code changes from v1.

Tristan Madani (2):
wifi: libertas: fix OOB read from firmware pkt_ptr offset in RX path
wifi: libertas: fix OOB read from firmware bssdescriptsize in scan
response

drivers/net/wireless/marvell/libertas/cfg.c | 8 ++++++++
drivers/net/wireless/marvell/libertas/rx.c | 9 +++++++++
2 files changed, 17 insertions(+)

--
2.47.3