github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-13 13:51:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: iwlwifi: mld: validate D3_END notif size

Browse Source 
Check D3_END_NOTIFICATION payload length before reading notif->flags.
On short payloads, mark notif handling as failed.
Avoid out-of-bounds reads from malformed notifications.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714165826.db2df8b6b6bb.I6163bbdf433379bf1dbf9eb46fb9562892217bd7@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
This commit is contained in:
Emmanuel Grumbach 2026-07-14 17:02:12 +03:00 committed by Miri Korenblit
parent c99bc4d4e0
commit 4e777dcdfe
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/net/wireless/intel/iwlwifi/mld/d3.c
View File

@ -1449,8 +1449,16 @@ static bool iwl_mld_handle_d3_notif(struct iwl_notif_wait_data *notif_wait,
}
case WIDE_ID(PROT_OFFLOAD_GROUP, D3_END_NOTIFICATION): {
struct iwl_d3_end_notif *notif = (void *)pkt->data;
u32 len = iwl_rx_packet_payload_len(pkt);
if (IWL_FW_CHECK(mld, len < sizeof(*notif),
"Invalid D3_END notification (expected=%zu got=%u)\n",
sizeof(*notif), len)) {
resume_data->notif_handling_err = true;
} else {
resume_data->d3_end_flags = le32_to_cpu(notif->flags);
}
resume_data->d3_end_flags = le32_to_cpu(notif->flags);
resume_data->notifs_received |= IWL_D3_NOTIF_D3_END_NOTIF;
break;
}