From: Luca Coelho <luca@coelho.fi>
To: kvalo@codeaurora.org
Cc: linux-wireless@vger.kernel.org
Subject: [PATCH 02/11] iwlwifi: mvm: check more notification sizes
Date: Sun, 17 Jan 2021 13:10:29 +0200 [thread overview]
Message-ID: <iwlwifi.20210117130510.1370c776cb31.Ic536bd1aee5368969fbf65db85b9b9b5dc9c6034@changeid> (raw)
In-Reply-To: <20210117111038.1402870-1-luca@coelho.fi>
From: Johannes Berg <johannes.berg@intel.com>
Some notifications aren't handled by the general RX handler
code, due to multi-queue. Add size checks for them explicitly.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 4 ++++
drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c | 9 +++++++++
2 files changed, 13 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 2a57e51f056a..8ef5399ad9be 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -20,6 +20,10 @@
void iwl_mvm_rx_rx_phy_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
{
struct iwl_rx_packet *pkt = rxb_addr(rxb);
+ unsigned int pkt_len = iwl_rx_packet_payload_len(pkt);
+
+ if (unlikely(pkt_len < sizeof(mvm->last_phy_info)))
+ return;
memcpy(&mvm->last_phy_info, pkt->data, sizeof(mvm->last_phy_info));
mvm->ampdu_ref++;
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 4dc7c65a1130..7509d73ae724 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -1938,6 +1938,9 @@ void iwl_mvm_rx_monitor_no_data(struct iwl_mvm *mvm, struct napi_struct *napi,
.info_type = IWL_RX_PHY_INFO_TYPE_NONE,
};
+ if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*desc)))
+ return;
+
if (unlikely(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)))
return;
@@ -2067,6 +2070,9 @@ void iwl_mvm_rx_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
struct iwl_rx_packet *pkt = rxb_addr(rxb);
struct iwl_frame_release *release = (void *)pkt->data;
+ if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release)))
+ return;
+
iwl_mvm_release_frames_from_notif(mvm, napi, release->baid,
le16_to_cpu(release->nssn),
queue, 0);
@@ -2087,6 +2093,9 @@ void iwl_mvm_rx_bar_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
IWL_BAR_FRAME_RELEASE_TID_MASK);
struct iwl_mvm_baid_data *baid_data;
+ if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release)))
+ return;
+
if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID ||
baid >= ARRAY_SIZE(mvm->baid_map)))
return;
--
2.29.2
next prev parent reply other threads:[~2021-01-17 11:11 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-17 11:10 [PATCH 00/11] iwlwifi: updates intended for v5.12 2021-01-17 Luca Coelho
2021-01-17 11:10 ` [PATCH 01/11] iwlwifi: mvm: add notification size checks Luca Coelho
2021-02-05 9:53 ` Luca Coelho
2021-01-17 11:10 ` Luca Coelho [this message]
2021-01-17 11:10 ` [PATCH 03/11] iwlwifi: mvm: remove debugfs injection limitations Luca Coelho
2021-01-17 11:10 ` [PATCH 04/11] iwlwifi: mvm: scan: fix scheduled scan restart handling Luca Coelho
2021-01-17 11:10 ` [PATCH 05/11] iwlwifi: mvm: handle CCA-EXT delay firmware notification Luca Coelho
2021-01-17 11:10 ` [PATCH 06/11] iwlwifi: mvm: add support for new flush queue response Luca Coelho
2021-01-17 11:10 ` [PATCH 07/11] iwlwifi: pcie: properly implement NAPI Luca Coelho
2021-01-17 11:10 ` [PATCH 08/11] iwl-trans: iwlwifi: move sync NMI logic to trans Luca Coelho
2021-01-17 11:10 ` [PATCH 09/11] iwlwifi: dbg: dump paged memory from index 1 Luca Coelho
2021-01-17 11:10 ` [PATCH 10/11] iwlwifi: remove TRANS_PM_OPS Luca Coelho
2021-01-17 11:10 ` [PATCH 11/11] iwlwifi: mvm: don't check system_pm_mode without mutex held Luca Coelho
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=iwlwifi.20210117130510.1370c776cb31.Ic536bd1aee5368969fbf65db85b9b9b5dc9c6034@changeid \
--to=luca@coelho.fi \
--cc=kvalo@codeaurora.org \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).