summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/intel/iwlwifi/dvm
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2020-12-10 00:16:24 +0300
committerLuca Coelho <luciano.coelho@intel.com>2020-12-10 01:14:14 +0300
commitefc0ec5afb6e1488b3bdc4bbf85533d79d7e5f9f (patch)
tree5c9ab5906333368c61f7cf9bf6efd5136e76f135 /drivers/net/wireless/intel/iwlwifi/dvm
parentc6bae216907119a39e204a5011bd22e6c816cedb (diff)
downloadlinux-efc0ec5afb6e1488b3bdc4bbf85533d79d7e5f9f.tar.xz
iwlwifi: validate MPDU length against notification length
The MPDU contained in a notification shouldn't be larger than the notification size itself is, validate this. Reported-by: Haggai Abramovsky <haggai.abramovsky@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Link: https://lore.kernel.org/r/iwlwifi.20201209231352.7c721ad37014.Id5746874ecfa208b60baa62691b2d9dc5dd4d89c@changeid Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/dvm')
-rw-r--r--drivers/net/wireless/intel/iwlwifi/dvm/rx.c10
1 files changed, 8 insertions, 2 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
index 9d55ece05020..d06278558b33 100644
--- a/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/dvm/rx.c
@@ -3,7 +3,7 @@
*
* Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
* Copyright(c) 2015 Intel Deutschland GmbH
- * Copyright(c) 2018 Intel Corporation
+ * Copyright(c) 2018, 2020 Intel Corporation
*
* Portions of this file are derived from the ipw3945 project, as well
* as portionhelp of the ieee80211 subsystem header files.
@@ -786,7 +786,7 @@ static void iwlagn_rx_reply_rx(struct iwl_priv *priv,
struct iwl_rx_phy_res *phy_res;
__le32 rx_pkt_status;
struct iwl_rx_mpdu_res_start *amsdu;
- u32 len;
+ u32 len, pkt_len = iwl_rx_packet_len(pkt);
u32 ampdu_status;
u32 rate_n_flags;
@@ -798,6 +798,12 @@ static void iwlagn_rx_reply_rx(struct iwl_priv *priv,
amsdu = (struct iwl_rx_mpdu_res_start *)pkt->data;
header = (struct ieee80211_hdr *)(pkt->data + sizeof(*amsdu));
len = le16_to_cpu(amsdu->byte_count);
+
+ if (unlikely(len + sizeof(*amsdu) + sizeof(__le32) > pkt_len)) {
+ IWL_DEBUG_DROP(priv, "FW lied about packet len\n");
+ return;
+ }
+
rx_pkt_status = *(__le32 *)(pkt->data + sizeof(*amsdu) + len);
ampdu_status = iwlagn_translate_rx_status(priv,
le32_to_cpu(rx_pkt_status));