wifi: rsi: bound background scan probe request copy

rsi_send_bgscan_probe_req() allocates room for struct
rsi_bgscan_probe plus MAX_BGSCAN_PROBE_REQ_LEN bytes, but copies the
entire mac80211-generated probe request skb after the fixed header.
The probe request length depends on scan IEs and is not checked
against the fixed firmware buffer.

Reject generated probe requests that do not fit the firmware command
buffer before copying them into the skb.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260704011231.45593-1-pengpeng@iscas.ac.cn
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/rsi/rsi_91x_mgmt.c b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
index 2ddf4d158bfe3e322cffdb6344714cf9172427f1..bb167f03367bf7dc4a4876818486e74dc8d423cb 100644 (file)
--- a/drivers/net/wireless/rsi/rsi_91x_mgmt.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mgmt.c
@@ -1913,6 +1913,12 @@ int rsi_send_bgscan_probe_req(struct rsi_common *common,
                return -ENOMEM;
        }
 
+       if (probereq_skb->len > MAX_BGSCAN_PROBE_REQ_LEN) {
+               dev_kfree_skb(probereq_skb);
+               dev_kfree_skb(skb);
+               return -EINVAL;
+       }
+
        memcpy(&skb->data[frame_len], probereq_skb->data, probereq_skb->len);
 
        bgscan->probe_req_length = cpu_to_le16(probereq_skb->len);