[PATCH v3 1/2] wifi: libertas: fix OOB read from firmware pkt_ptr offset in RX path

Tristan Madani
2026-04-21T13:50:31Z

From: Tristan Madani <tristan@talencesecurity.com>

lbs_process_rxed_packet() uses the firmware-supplied pkt_ptr as an
offset into the skb data without validating that it falls within the
skb buffer bounds. A malicious pkt_ptr value causes out-of-bounds
memory access when the function subsequently reads ethernet header
fields from p_rx_pkt.

Add a bounds check to ensure pkt_ptr plus the minimum packet header
size does not exceed skb->len.

Fixes: e45d8e534b67 ("libertas: add support for Marvell SD8688 chip")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v3:
- Regenerated from wireless-next with proper git format-patch to
produce valid index hashes (v2 had post-processed index lines).

Changes in v2:
- No code changes from v1.

drivers/net/wireless/marvell/libertas/rx.c | 9 +++++++++
1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/marvell/libertas/rx.c b/drivers/net/wireless/marvell/libertas/rx.c
index c34d30f7cbe03..3497595a67595 100644
--- a/drivers/net/wireless/marvell/libertas/rx.c
+++ b/drivers/net/wireless/marvell/libertas/rx.c
@@ -73,6 +73,15 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
}

p_rx_pd = (struct rxpd *) skb->data;
+
+ if (le32_to_cpu(p_rx_pd->pkt_ptr) + sizeof(struct rxpackethdr) >
+ skb->len) {
+ lbs_deb_rx("rx err: pkt_ptr %u beyond skb len %u\n",
+ le32_to_cpu(p_rx_pd->pkt_ptr), skb->len);
+ ret = -EINVAL;
+ dev_kfree_skb(skb);
+ goto done;
+ }
p_rx_pkt = (struct rxpackethdr *) ((u8 *)p_rx_pd +
le32_to_cpu(p_rx_pd->pkt_ptr));

--
2.47.3