diff options
| author | Amir Mohammad Jahangirzad <a.jahangirzad@gmail.com> | 2026-04-18 03:42:47 +0300 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-04-27 13:40:32 +0300 |
| commit | 3994b4afd521d60e47e012fe2ed7b606aaec370b (patch) | |
| tree | 5cd25a7990a4f3922ec022763ec993699979d9fe | |
| parent | a035766f970bde2d4298346a31a80685be5c0205 (diff) | |
| download | linux-3994b4afd521d60e47e012fe2ed7b606aaec370b.tar.xz | |
wifi: libertas: fix integer underflow in process_cmdrequest()
The existing validation only checks if recvlength exceeds
LBS_CMD_BUFFER_SIZE, but doesn't check the lower bound. When a
USB device sends a response shorter than MESSAGE_HEADER_LEN, the
subtraction (recvlength - MESSAGE_HEADER_LEN) wraps to a huge
value, causing memcpy to corrupt the heap.
Add the same lower bound check that libertas_tf already has.
Signed-off-by: Amir Mohammad Jahangirzad <a.jahangirzad@gmail.com>
Link: https://patch.msgid.link/20260418004247.368944-1-a.jahangirzad@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | drivers/net/wireless/marvell/libertas/if_usb.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/marvell/libertas/if_usb.c b/drivers/net/wireless/marvell/libertas/if_usb.c index 4fae0e335136..a00d53350fa9 100644 --- a/drivers/net/wireless/marvell/libertas/if_usb.c +++ b/drivers/net/wireless/marvell/libertas/if_usb.c @@ -633,9 +633,10 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, unsigned long flags; u8 i; - if (recvlength > LBS_CMD_BUFFER_SIZE) { + if (recvlength < MESSAGE_HEADER_LEN || + recvlength > LBS_CMD_BUFFER_SIZE) { lbs_deb_usbd(&cardp->udev->dev, - "The receive buffer is too large\n"); + "The receive buffer is invalid: %d\n", recvlength); kfree_skb(skb); return; } |