diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2020-12-09 23:16:24 +0200 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2020-12-10 00:14:14 +0200 |
| commit | efc0ec5afb6e1488b3bdc4bbf85533d79d7e5f9f (patch) | |
| tree | 5c9ab5906333368c61f7cf9bf6efd5136e76f135 /drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | |
| parent | c6bae216907119a39e204a5011bd22e6c816cedb (diff) | |
iwlwifi: validate MPDU length against notification length
The MPDU contained in a notification shouldn't be larger than the
notification size itself is, validate this.
Reported-by: Haggai Abramovsky <haggai.abramovsky@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20201209231352.7c721ad37014.Id5746874ecfa208b60baa62691b2d9dc5dd4d89c@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c index 22bd3a84aaac..1d51ec95ec21 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c @@ -1607,6 +1607,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi, struct iwl_rx_mpdu_desc *desc = (void *)pkt->data; struct ieee80211_hdr *hdr; u32 len = le16_to_cpu(desc->mpdu_len); + u32 pkt_len = iwl_rx_packet_payload_len(pkt); u32 rate_n_flags, gp2_on_air_rise; u16 phy_info = le16_to_cpu(desc->phy_info); struct ieee80211_sta *sta = NULL; @@ -1653,6 +1654,11 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi, le32_get_bits(phy_data.d1, IWL_RX_PHY_DATA1_INFO_TYPE_MASK); + if (len + desc_size > pkt_len) { + IWL_DEBUG_DROP(mvm, "FW lied about packet len\n"); + return; + } + hdr = (void *)(pkt->data + desc_size); /* Dont use dev_alloc_skb(), we'll have enough headroom once * ieee80211_hdr pulled. |