@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright (C) 2005-2014 Intel Corporation
+ * Copyright (C) 2005-2014, 2020 Intel Corporation
* Copyright (C) 2016 Intel Deutschland GmbH
*/
#include <linux/slab.h>
@@ -147,13 +147,23 @@ IWL_EXPORT_SYMBOL(iwl_phy_db_free);
int iwl_phy_db_set_section(struct iwl_phy_db *phy_db,
struct iwl_rx_packet *pkt)
{
+ unsigned int pkt_len = iwl_rx_packet_payload_len(pkt);
struct iwl_calib_res_notif_phy_db *phy_db_notif =
(struct iwl_calib_res_notif_phy_db *)pkt->data;
- enum iwl_phy_db_section_type type = le16_to_cpu(phy_db_notif->type);
- u16 size = le16_to_cpu(phy_db_notif->length);
+ enum iwl_phy_db_section_type type;
+ u16 size;
struct iwl_phy_db_entry *entry;
u16 chg_id = 0;
+ if (pkt_len < sizeof(*phy_db_notif))
+ return -EINVAL;
+
+ type = le16_to_cpu(phy_db_notif->type);
+ size = le16_to_cpu(phy_db_notif->length);
+
+ if (pkt_len < sizeof(*phy_db_notif) + size)
+ return -EINVAL;
+
if (!phy_db)
return -EINVAL;
@@ -160,6 +160,7 @@ void iwl_mvm_mfu_assert_dump_notif(struct iwl_mvm *mvm,
static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
struct iwl_rx_packet *pkt, void *data)
{
+ unsigned int pkt_len = iwl_rx_packet_payload_len(pkt);
struct iwl_mvm *mvm =
container_of(notif_wait, struct iwl_mvm, notif_wait);
struct iwl_mvm_alive_data *alive_data = data;
@@ -177,6 +178,9 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
UCODE_ALIVE_NTFY, 0) == 5) {
struct iwl_alive_ntf_v5 *palive;
+ if (pkt_len < sizeof(*palive))
+ return false;
+
palive = (void *)pkt->data;
umac = &palive->umac_data;
lmac1 = &palive->lmac_data[0];
@@ -194,6 +198,9 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
} else if (iwl_rx_packet_payload_len(pkt) == sizeof(struct iwl_alive_ntf_v4)) {
struct iwl_alive_ntf_v4 *palive;
+ if (pkt_len < sizeof(*palive))
+ return false;
+
palive = (void *)pkt->data;
umac = &palive->umac_data;
lmac1 = &palive->lmac_data[0];
@@ -203,6 +210,9 @@ static bool iwl_alive_fn(struct iwl_notif_wait_data *notif_wait,
sizeof(struct iwl_alive_ntf_v3)) {
struct iwl_alive_ntf_v3 *palive3;
+ if (pkt_len < sizeof(*palive3))
+ return false;
+
palive3 = (void *)pkt->data;
umac = &palive3->umac_data;
lmac1 = &palive3->lmac_data;