diff options
| author |   Johannes Berg <johannes.berg@intel.com> | 2021-01-17 13:10:29 +0200 |
|---|---|---|
| committer |   Luca Coelho <luciano.coelho@intel.com> | 2021-02-05 11:52:27 +0200 |
| commit | 1e1a58bec773a6c377fd31625650ed5aaaf6e93f (patch) | |
| tree | 5924b8c5ce6adefe8b2453e38c2faa4d779c1d00 | |
| parent | iwlwifi: mvm: add notification size checks (diff) | |
| download | linux-dev-1e1a58bec773a6c377fd31625650ed5aaaf6e93f.tar.xz linux-dev-1e1a58bec773a6c377fd31625650ed5aaaf6e93f.zip | |
iwlwifi: mvm: check more notification sizes
Some notifications aren't handled by the general RX handler
code, due to multi-queue. Add size checks for them explicitly.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210117130510.1370c776cb31.Ic536bd1aee5368969fbf65db85b9b9b5dc9c6034@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 4 | ||||
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 9 |
2 files changed, 13 insertions, 0 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c index 2a57e51f056a..8ef5399ad9be 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c @@ -20,6 +20,10 @@ void iwl_mvm_rx_rx_phy_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb) { struct iwl_rx_packet *pkt = rxb_addr(rxb); + unsigned int pkt_len = iwl_rx_packet_payload_len(pkt); + + if (unlikely(pkt_len < sizeof(mvm->last_phy_info))) + return; memcpy(&mvm->last_phy_info, pkt->data, sizeof(mvm->last_phy_info)); mvm->ampdu_ref++; diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c index 4dc7c65a1130..7509d73ae724 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c @@ -1938,6 +1938,9 @@ void iwl_mvm_rx_monitor_no_data(struct iwl_mvm *mvm, struct napi_struct *napi, .info_type = IWL_RX_PHY_INFO_TYPE_NONE, }; + if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*desc))) + return; + if (unlikely(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status))) return; @@ -2067,6 +2070,9 @@ void iwl_mvm_rx_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi, struct iwl_rx_packet *pkt = rxb_addr(rxb); struct iwl_frame_release *release = (void *)pkt->data; + if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release))) + return; + iwl_mvm_release_frames_from_notif(mvm, napi, release->baid, le16_to_cpu(release->nssn), queue, 0); @@ -2087,6 +2093,9 @@ void iwl_mvm_rx_bar_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi, IWL_BAR_FRAME_RELEASE_TID_MASK); struct iwl_mvm_baid_data *baid_data; + if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release))) + return; + if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID || baid >= ARRAY_SIZE(mvm->baid_map))) return; |