Johannes Berg 05ad5a4d42 wifi: iwlwifi: mvm: don't trust firmware n_channels ...

[ Upstream commit 682b6dc29d ]

If the firmware sends us a corrupted MCC response with
n_channels much larger than the command response can be,
we might copy far too much (uninitialized) memory and
even crash if the n_channels is large enough to make it
run out of the one page allocated for the FW response.

Fix that by checking the lengths. Doing a < comparison
would be sufficient, but the firmware should be doing
it correctly, so check more strictly.

Fixes: dcaf9f5ecb ("iwlwifi: mvm: add MCC update FW API")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230514120631.d7b233139eb4.I51fd319df8e9d41881fc8450e83d78049518a79a@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2023-05-24 17:36:51 +01:00

..

ipw2x00

wifi: ipw2200: fix memory leak in ipw_wdev_init()

2023-03-10 09:39:07 +01:00

iwlegacy

wifi: iwl4965: Add missing check for create_singlethread_workqueue()

2023-03-10 09:39:17 +01:00

iwlwifi

wifi: iwlwifi: mvm: don't trust firmware n_channels

2023-05-24 17:36:51 +01:00

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

Makefile

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21 10:50:46 +02:00