diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2021-01-17 13:10:28 +0200 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2021-02-05 11:52:24 +0200 |
| commit | afc857bc2a71905b23bbe1894dbadb2915a3ac4d (patch) | |
| tree | 7a0e69dba312c8a70a4c03e7086ede0077abb73a /drivers/net/wireless/intel/iwlwifi/mvm/rx.c | |
| parent | 4832bb371c4175ffb506a96accbb08ef2b2466e7 (diff) | |
iwlwifi: mvm: add notification size checks
We shouldn't trust the firmware with the sizes (or contents)
of notifications, accessing too much data could cause page
faults if the data doesn't fit into the allocated space. This
applies more on older NICs where multiple notifications can
be in a single RX buffer.
Add a general framework for checking a minimum size of any
notification in the RX handlers and use it for most. Some RX
handlers were already checking and I've moved the checks,
some more complex checks I left and made them _NO_SIZE for
the RX handlers.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210117130510.3e155d5e5f90.I2121fa4ac7cd7eb98970d84b793796646afa3eed@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/rx.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c index f0364add85f9..2a57e51f056a 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c @@ -874,12 +874,11 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm, struct iwl_rx_packet *pkt = rxb_addr(rxb); struct iwl_ba_window_status_notif *notif = (void *)pkt->data; int i; - u32 pkt_len = iwl_rx_packet_payload_len(pkt); - if (WARN_ONCE(pkt_len != sizeof(*notif), - "Received window status notification of wrong size (%u)\n", - pkt_len)) - return; + BUILD_BUG_ON(ARRAY_SIZE(notif->ra_tid) != BA_WINDOW_STREAMS_MAX); + BUILD_BUG_ON(ARRAY_SIZE(notif->mpdu_rx_count) != BA_WINDOW_STREAMS_MAX); + BUILD_BUG_ON(ARRAY_SIZE(notif->bitmap) != BA_WINDOW_STREAMS_MAX); + BUILD_BUG_ON(ARRAY_SIZE(notif->start_seq_num) != BA_WINDOW_STREAMS_MAX); rcu_read_lock(); for (i = 0; i < BA_WINDOW_STREAMS_MAX; i++) { |