diff options
| author | Felix Hoffmann <f3lix.dev@gmx.de> | 2026-10-07 11:30:21 +0200 |
|---|---|---|
| committer | Lachlan Hodges <lachlan.hodges@morsemicro.com> | 2026-10-08 10:36:12 +1100 |
| commit | 7e6689cbbf9e6040e4ce38656a126459aa994f68 (patch) | |
| tree | 774a48a3bc5006cacf4a52f0f25ac30b65f78d42 | |
| parent | 4ec869de9c62ff34db1a31fca84c096961175035 (diff) | |
wifi: mm81x: validate YAPS receive framing
The receive byte count comes from device-controlled status registers, but
the packet splitter unconditionally consumes a four-byte delimiter. A count
of one to three bytes therefore makes bytes_remaining negative. If the
reused receive buffer contains a valid delimiter, the negative value is
passed to memcpy() and converted to a near-SIZE_MAX length, corrupting
kernel memory.
YAPS streams are word aligned, so reject byte counts that cannot contain
complete delimiters. Also reject delimiter sizes which do not leave any
packet data after removing the reserved metadata page.
Assisted-by: LLM
Fixes: b1906cea00b0 ("wifi: mm81x: add mm81x Wi-Fi HaLow driver")
Signed-off-by: Felix Hoffmann <f3lix.dev@gmx.de>
Link: https://patch.msgid.link/20261007093021.17132-1-f3lix.dev@gmx.de
[remove Suggested-by and fix Assisted-by]
Signed-off-by: Lachlan Hodges <lachlan.hodges@morsemicro.com>
| -rw-r--r-- | drivers/net/wireless/morsemicro/mm81x/yaps_hw.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c b/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c index e1102b8fb802..1d90137470c2 100644 --- a/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c +++ b/drivers/net/wireless/morsemicro/mm81x/yaps_hw.c @@ -401,16 +401,17 @@ exit: static bool mm81x_read_pkts_h_is_valid_delim(u32 delim) { u8 calc_crc = mm81x_yaps_hw_crc(delim); - int pkt_size = YAPS_DELIM_GET_PHANDLE_SIZE(delim); + int pkt_size = YAPS_DELIM_GET_PKT_SIZE(delim); int padding = YAPS_DELIM_GET_PADDING(delim); if (calc_crc != YAPS_DELIM_GET_CRC(delim)) return false; - if (pkt_size == 0) + if (pkt_size <= 0) return false; - if ((pkt_size + padding) > YAPS_MAX_PKT_SIZE_BYTES) + if ((pkt_size + YAPS_RESERVED_PAGE_SIZE + padding) > + YAPS_MAX_PKT_SIZE_BYTES) return false; /* Pkt length + padding should not require more padding */ @@ -455,6 +456,10 @@ static int mm81x_yaps_hw_read_pkts(struct mm81x_yaps *yaps, return 0; if (bytes_remaining < 0) return bytes_remaining; + if (!IS_ALIGNED(bytes_remaining, sizeof(u32))) { + dev_warn(yaps->mors->dev, "yaps truncated delimiter"); + return -EIO; + } if (bytes_remaining > YAPS_HW_WINDOW_SIZE_BYTES) { bytes_remaining = YAPS_HW_WINDOW_SIZE_BYTES; |