diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2021-01-17 16:52:33 +0200 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2021-02-05 11:55:20 +0200 |
| commit | 5c255a10711b139877044164b5822ef4e8811c7c (patch) | |
| tree | e03a17ddd145366439005c5429473d6f3dde6b20 /drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | |
| parent | 9aae43a450e89db2f293d310b4342342388d2e96 (diff) | |
iwlwifi: mvm: debugfs: check length precisely in inject_packet
When we check the length, we only check that the advertised
data length fits into the data we have, but currently not
that it actually matches correctly.
This should be harmless, but if the first two bytes are zero,
then the iwl_rx_packet_payload_len() ends up negative, and
that might later cause issues if unsigned variables are used,
as this is not something that's normally expected.
Change the validation here to precisely validate the lengths
match, to avoid such issues.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210117164916.5184dfc2a445.I0631d2e4f6ffb93cf06618edb035c45bd6d1d7b9@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c index 231c3489cc31..3834d7197e11 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c @@ -1169,9 +1169,9 @@ static ssize_t iwl_dbgfs_inject_packet_write(struct iwl_mvm *mvm, if (ret) goto out; - /* avoid invalid memory access */ + /* avoid invalid memory access and malformed packet */ if (bin_len < sizeof(*pkt) || - bin_len < sizeof(*pkt) + iwl_rx_packet_payload_len(pkt)) + bin_len != sizeof(*pkt) + iwl_rx_packet_payload_len(pkt)) goto out; local_bh_disable(); |