[PATCH] wifi: libertas_tf: Fix slab-out-of-bounds write in if_usb_send_fw_pkt()

[Johan Hovold]

On Tue, Aug 25, 2026 at 05:24:06PM +0800, Yang Zi wrote:
> if_usb_send_fw_pkt() copies a firmware block into the driver's
> ep_out_buf using the length taken directly from the firmware header
> (fwdata->hdr.datalength) without any validation.  That same untrusted
> value is also used as the USB transfer length and to advance
> cardp->totalbytes.
> 
> A crafted or truncated firmware image can set datalength to a huge value,
> which makes the memcpy() into fwdata->data write far past the end of the
> 1574-byte ep_out_buf (KASAN reports a ~3.5 GiB slab-out-of-bounds write)
> and, once totalbytes has run away, makes the subsequent header memcpy()
> read past the end of the firmware image.
> 
> check_fwfile_format() only checks the cumulative length and never bounds
> an individual block, and FW_MAX_DATA_BLK_SIZE (600) is never used.
> 
> Validate the block length in if_usb_send_fw_pkt(): reject any block whose
> datalength exceeds FW_MAX_DATA_BLK_SIZE or the number of bytes remaining
> in the firmware image, and return -EINVAL before the memcpy().  Also
> enforce the per-block upper bound in check_fwfile_format() so that
> invalid images are rejected up front.
> 
> Signed-off-by: Yang Zi <2959243019 at qq.com>

Missing Assisted-by tag here too?

This patch is also corrupt and cannot be applied.

Johan