[PATCH] wifi: mwifiex: validate sta_count in UAP sta list response
From: Aamir Ahmed <hidden>
Date: 2026-09-07 03:10:27
Subsystem:
marvell mwifiex wireless driver, the rest · Maintainers:
Brian Norris, Linus Torvalds
mwifiex_ret_uap_sta_list() iterates over sta_count entries
from the firmware response without checking that the response
buffer is large enough to contain them. A firmware response
with a large sta_count can cause out-of-bounds reads beyond
the command response buffer.
Validate that the response size can accommodate the claimed
number of station info entries before iterating.
Fixes: b21783e94e20 ("mwifiex: add sta_list firmware command")
Signed-off-by: Aamir Ahmed <redacted>
---
drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
index 85512f526c5f..7ae1efe46256 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c@@ -974,10 +974,16 @@ static int mwifiex_ret_uap_sta_list(struct mwifiex_private *priv, struct host_cmd_ds_sta_list *sta_list = &resp->params.sta_list; struct mwifiex_ie_types_sta_info *sta_info = (void *)&sta_list->tlv; + u16 sta_count = le16_to_cpu(sta_list->sta_count); int i; struct mwifiex_sta_node *sta_node; - for (i = 0; i < (le16_to_cpu(sta_list->sta_count)); i++) { + if (le16_to_cpu(resp->size) < + S_DS_GEN + sizeof(*sta_list) + + sta_count * sizeof(*sta_info)) + return -EINVAL; + + for (i = 0; i < sta_count; i++) { sta_node = mwifiex_get_sta_entry(priv, sta_info->mac); if (unlikely(!sta_node)) continue;
--
2.43.0