[PATCH v2 3/6] wifi: mwifiex: fix OOB read from firmware sta_count in station list response

Tristan Madani
2026-04-15T22:23:35Z

The firmware-controlled sta_count (u16) is used as an unbounded loop
counter for iterating station info entries. An inflated count drives
reads past the response buffer into kernel heap memory.

Add a check that sta_count fits within the response size.

Fixes: b21783e94e20 ("mwifiex: add sta_list firmware command")
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 8 ++++++++
1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
index XXXXXXX..XXXXXXX 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
@@ -976,7 +976,15 @@ static int mwifiex_ret_uap_sta_list(struct mwifiex_private *priv,
struct mwifiex_ie_types_sta_info *sta_info = (void *)&sta_list->tlv;
int i;
struct mwifiex_sta_node *sta_node;
+ u16 resp_size = le16_to_cpu(resp->size);
+ u16 count = le16_to_cpu(sta_list->sta_count);
+ u16 max_count;

+ if (resp_size < sizeof(*resp) - sizeof(resp->params) + sizeof(*sta_list))
+ return -EINVAL;
+ max_count = (resp_size - sizeof(*resp) + sizeof(resp->params) -
+ sizeof(*sta_list)) / sizeof(*sta_info);
+ count = min(count, max_count);
- for (i = 0; i < (le16_to_cpu(sta_list->sta_count)); i++) {
+ for (i = 0; i < count; i++) {
sta_node = mwifiex_get_sta_entry(priv, sta_info->mac);
if (unlikely(!sta_node))
continue;