wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats()
authorBaochen Qiang <quic_bqiang@quicinc.com>
Fri, 1 Sep 2023 01:56:02 +0000 (09:56 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 28 Nov 2023 17:19:37 +0000 (17:19 +0000)
commitc9e44111da221246efb2e623ae1be40a5cf6542c
tree46c6473c8fbedd4756e9d25125b8b66579bb34df
parent8954a159d137b3135a97e09934f220ad1576da17
wifi: ath12k: fix possible out-of-bound read in ath12k_htt_pull_ppdu_stats()

[ Upstream commit 1bc44a505a229bb1dd4957e11aa594edeea3690e ]

len is extracted from HTT message and could be an unexpected value in
case errors happen, so add validation before using to avoid possible
out-of-bound read in the following message iteration and parsing.

The same issue also applies to ppdu_info->ppdu_stats.common.num_users,
so validate it before using too.

These are found during code review.

Compile test only.

Signed-off-by: Baochen Qiang <quic_bqiang@quicinc.com>
Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230901015602.45112-1-quic_bqiang@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/ath/ath12k/dp_rx.c