wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats()

Browse source

len is extracted from HTT message and could be an unexpected value in
case errors happen, so add validation before using to avoid possible
out-of-bound read in the following message iteration and parsing.

The same issue also applies to ppdu_info->ppdu_stats.common.num_users,
so validate it before using too.

These are found during code review.

Compile test only.

Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230901015602.45112-1-quic_bqiang@quicinc.com

...

This commit is contained in:

Baochen Qiang 2023-09-01 09:56:02 +08:00 • committed by Kalle Valo

parent 41e7a399ae

commit 1bc44a505a

1 changed files with 17 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

17

drivers/net/wireless/ath/ath12k/dp_rx.c

View file