[PATCH] wifi: libertas: fix RX OOB access from device-controlled pkt_ptr

[PATCH] wifi: libertas: fix RX OOB access from device-controlled pkt_ptr

[Tianchu Chen]

From: Tianchu Chen <flynnnchen@tencent.com>

lbs_process_rxed_packet() computes the packet header pointer as
skb->data + rxpd->pkt_ptr, where pkt_ptr is a 32-bit value supplied
by the device, and never checks it against the packet length. The
only validation (skb->len < ETH_HLEN + 8 + sizeof(struct rxpd))
bounds the total length, not pkt_ptr.

A bogus device can report an arbitrary pkt_ptr:

- the memcmp() against the RFC1042 header reads 6 bytes at
  pkt_ptr + 14, potentially past the skb buffer
- if the compared bytes happen to match, the EthernetII header
  reconstruction writes 12 bytes at pkt_ptr + 8;
- hdrchop derived from pkt_ptr is later passed to skb_pull().

Validate pkt_ptr before using it: it must leave room for a full
struct rxpackethdr within the received frame. It is not expected
to affect the driver behavior in most cases, only invalid pkt_ptr
packets being dropped.

Discovered by Atuin - Automated Vulnerability Discovery Engine.

Fixes: e45d8e534b67 ("libertas: add support for Marvell SD8688 chip")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
---
 drivers/net/wireless/marvell/libertas/rx.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/net/wireless/marvell/libertas/rx.c b/drivers/net/wireless/marvell/libertas/rx.c
index c34d30f7cbe03..a9d1320d90b15 100644
--- a/drivers/net/wireless/marvell/libertas/rx.c
+++ b/drivers/net/wireless/marvell/libertas/rx.c
@@ -89,6 +89,15 @@ int lbs_process_rxed_packet(struct lbs_private *priv, struct sk_buff *skb)
 		goto done;
 	}
 
+	if (le32_to_cpu(p_rx_pd->pkt_ptr) >
+	    skb->len - sizeof(struct rxpackethdr)) {
+		lbs_deb_rx("rx err: pkt_ptr beyond packet\n");
+		dev->stats.rx_length_errors++;
+		ret = -EINVAL;
+		dev_kfree_skb(skb);
+		goto done;
+	}
+
 	lbs_deb_rx("rx data: skb->len - pkt_ptr = %d-%zd = %zd\n",
 		skb->len, (size_t)le32_to_cpu(p_rx_pd->pkt_ptr),
 		skb->len - (size_t)le32_to_cpu(p_rx_pd->pkt_ptr));
-- 
2.51.0