diff options
| author |   Alexey Velichayshiy <a.velichayshiy@ispras.ru> | 2026-02-07 18:03:22 +0300 |
|---|---|---|
| committer |   Johannes Berg <johannes.berg@intel.com> | 2026-03-24 16:03:48 +0100 |
| commit | 744fabc338e87b95c4d1ff7c95bc8c0f834c6d99 (patch) | |
| tree | 979fea79e60ab8f2cb54b5082ab209ad3ce16acc /rust/kernel/ssh:/git@git.zx2c4.com | |
| parent | Merge tag 'ath-current-20260324' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath (diff) | |
wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
The memcpy function assumes the dynamic array notif->matches is at least
as large as the number of bytes to copy. Otherwise, results->matches may
contain unwanted data. To guarantee safety, extend the validation in one
of the checks to ensure sufficient packet length.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Cc: stable@vger.kernel.org
Fixes: 5ac54afd4d97 ("wifi: iwlwifi: mvm: Add handling for scan offload match info notification")
Signed-off-by: Alexey Velichayshiy <a.velichayshiy@ispras.ru>
Link: https://patch.msgid.link/20260207150335.1013646-1-a.velichayshiy@ispras.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'rust/kernel/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions