github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-12 13:27:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: iwlwifi: mld: fix validation fallback in iwl_mld_notif_is_valid

Browse Source 
When a firmware notification version is not in the handler's
size table, iwl_mld_notif_is_valid() falls back to comparing
against the last known structure size but the comparison is
wrong: 'return size < last_known_size' returns true (accept)
for undersized payloads and false (reject) for payloads that
are large enough.

Instead of trying to accept notifications that are large enough,
just refuse the notification. We shouldn't ever get a
notification that is longer than what we expect.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715220243.e0b91efe689d.I7d7604be6819da263e9091370892e6b6f4c57913@changeid
This commit is contained in:
Emmanuel Grumbach 2026-07-15 22:04:21 +03:00 committed by Miri Korenblit
parent 71e67b4b59
commit 405ff50b72
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/wireless/intel/iwlwifi/mld/notif.c
View File

@ -517,7 +517,7 @@ iwl_mld_notif_is_valid(struct iwl_mld *mld, struct iwl_rx_packet *pkt,
handler->cmd_id, notif_ver,
handler->sizes[handler->n_sizes - 1].ver);
return size < handler->sizes[handler->n_sizes - 1].size;
return false;
}
struct iwl_async_handler_entry {