diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2023-05-14 12:15:53 +0300 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2023-05-16 10:27:05 -0700 |
| commit | 682b6dc29d98e857e6ca4bbc077c7dc2899b7473 (patch) | |
| tree | 426ab17ed5fdff5ac7a761a637ffad9dc87d2261 /scripts/gdb/linux/interrupts.py | |
| parent | d0246a0e49efee0f8649d0e4f2350614cdfe6565 (diff) | |
wifi: iwlwifi: mvm: don't trust firmware n_channels
If the firmware sends us a corrupted MCC response with
n_channels much larger than the command response can be,
we might copy far too much (uninitialized) memory and
even crash if the n_channels is large enough to make it
run out of the one page allocated for the FW response.
Fix that by checking the lengths. Doing a < comparison
would be sufficient, but the firmware should be doing
it correctly, so check more strictly.
Fixes: dcaf9f5ecb6f ("iwlwifi: mvm: add MCC update FW API")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230514120631.d7b233139eb4.I51fd319df8e9d41881fc8450e83d78049518a79a@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'scripts/gdb/linux/interrupts.py')
0 files changed, 0 insertions, 0 deletions