[PATCH v3 1/2] wifi: libertas: fix OOB read from firmware pkt_ptr offset in RX path

[Johannes Berg]

On Tue, 2026-04-21 at 13:50 +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan at talencesecurity.com>
> 
> lbs_process_rxed_packet() uses the firmware-supplied pkt_ptr as an
> offset into the skb data without validating that it falls within the
> skb buffer bounds. A malicious pkt_ptr value causes out-of-bounds
> memory access when the function subsequently reads ethernet header
> fields from p_rx_pkt.
> 
> Add a bounds check to ensure pkt_ptr plus the minimum packet header
> size does not exceed skb->len.

Please generally put a bit more thought into your patches.

> Fixes: e45d8e534b67 ("libertas: add support for Marvell SD8688 chip")
> Signed-off-by: Tristan Madani <tristan at talencesecurity.com>

I'll also note again that I don't find any tool/LLM disclosure
improbably, nobody really cares about these rivers any more?

>  	p_rx_pd = (struct rxpd *) skb->data;
> +
> +	if (le32_to_cpu(p_rx_pd->pkt_ptr) + sizeof(struct rxpackethdr) >
> +	    skb->len) {
> 

At this point you don't even know yet that the skb is long enough to
access p_r x_pd->pkt_ptr *itself*, so this can't be right.

There's a length check later that checks for

        if (skb->len < (ETH_HLEN + 8 + sizeof(struct rxpd))) {

which probably needs to be moved up _and_ improved, but you're not
actually checking things correctly.

How is it that whatever tool you're using to find these isn't
complaining about the fix??

johannes