iwlwifi: mvm: check more notification sizes

Some notifications aren't handled by the general RX handler
code, due to multi-queue. Add size checks for them explicitly.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20210117130510.1370c776cb31.Ic536bd1aee5368969fbf65db85b9b9b5dc9c6034@changeid
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 2a57e51f056ab145ce91f1ade5721ae8308323fd..8ef5399ad9be6d046105b92e80e68d6f5b776d81 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -20,6 +20,10 @@
 void iwl_mvm_rx_rx_phy_cmd(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb)
 {
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+       unsigned int pkt_len = iwl_rx_packet_payload_len(pkt);
+
+       if (unlikely(pkt_len < sizeof(mvm->last_phy_info)))
+               return;
 
        memcpy(&mvm->last_phy_info, pkt->data, sizeof(mvm->last_phy_info));
        mvm->ampdu_ref++;

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
index 4dc7c65a1130e2c5f3fdca323f77a98418ed37df..7509d73ae724ebdf99d10e21304cc8a648e9f800 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c
@@ -1938,6 +1938,9 @@ void iwl_mvm_rx_monitor_no_data(struct iwl_mvm *mvm, struct napi_struct *napi,
                .info_type = IWL_RX_PHY_INFO_TYPE_NONE,
        };
 
+       if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*desc)))
+               return;
+
        if (unlikely(test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)))
                return;
 
@@ -2067,6 +2070,9 @@ void iwl_mvm_rx_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
        struct iwl_rx_packet *pkt = rxb_addr(rxb);
        struct iwl_frame_release *release = (void *)pkt->data;
 
+       if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release)))
+               return;
+
        iwl_mvm_release_frames_from_notif(mvm, napi, release->baid,
                                          le16_to_cpu(release->nssn),
                                          queue, 0);
@@ -2087,6 +2093,9 @@ void iwl_mvm_rx_bar_frame_release(struct iwl_mvm *mvm, struct napi_struct *napi,
                                         IWL_BAR_FRAME_RELEASE_TID_MASK);
        struct iwl_mvm_baid_data *baid_data;
 
+       if (unlikely(iwl_rx_packet_payload_len(pkt) < sizeof(*release)))
+               return;
+
        if (WARN_ON_ONCE(baid == IWL_RX_REORDER_DATA_INVALID_BAID ||
                         baid >= ARRAY_SIZE(mvm->baid_map)))
                return;