diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2020-12-09 23:16:46 +0200 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2020-12-10 00:16:05 +0200 |
| commit | b8aba27cdc0ea6aaafacba3b899ff99d6d876fad (patch) | |
| tree | f95682ce970b9ec74e4d8427411b6ff83421bdd1 /drivers/net/wireless/intel/iwlwifi/mvm/rx.c | |
| parent | ac1a98e1e924e7e8d7c7e5b1ca8ddc522e10ddd0 (diff) | |
iwlwifi: tighten RX MPDU bounds checks
Previously, we added checks that the contained MPDU size is long
enough, but really we should also check that the notification
itself fits into the data. Add some checks for that.
Also add unlikely() annotations on the previously added checks.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.51cc04cf1e3e.I7bfd6809f8f5feb75f79397646e6656e95688a0e@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/rx.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c index 0d2f7b069a52..79d1778e6bc0 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c @@ -298,6 +298,11 @@ void iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct napi_struct *napi, u32 rx_pkt_status; u8 crypt_len = 0; + if (unlikely(pkt_len < sizeof(*rx_res))) { + IWL_DEBUG_DROP(mvm, "Bad REPLY_RX_MPDU_CMD size\n"); + return; + } + phy_info = &mvm->last_phy_info; rx_res = (struct iwl_rx_mpdu_res_start *)pkt->data; hdr = (struct ieee80211_hdr *)(pkt->data + sizeof(*rx_res)); |