From e53e136535ff1829e2db9a0d492305c8c7983dcd Mon Sep 17 00:00:00 2001 From: Vladimir Kondratiev Date: Sun, 12 May 2013 14:43:33 +0300 Subject: [PATCH] wil6210: Sanity check for reported DMA length If Rx descriptor contains garbage, it is possible to access memory beyond allocated buffer. Check this condition and drop Rx if reported length is unreasonable large Signed-off-by: Vladimir Kondratiev Signed-off-by: John W. Linville --- drivers/net/wireless/ath/wil6210/txrx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c index 6a20f0a18622c..92f18215014ce 100644 --- a/drivers/net/wireless/ath/wil6210/txrx.c +++ b/drivers/net/wireless/ath/wil6210/txrx.c @@ -349,7 +349,13 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil, d1 = wil_skb_rxdesc(skb); *d1 = *d; + wil_vring_advance_head(vring, 1); dmalen = le16_to_cpu(d1->dma.length); + if (dmalen > sz) { + wil_err(wil, "Rx size too large: %d bytes!\n", dmalen); + kfree(skb); + return NULL; + } skb_trim(skb, dmalen); wil->stats.last_mcs_rx = wil_rxdesc_mcs(d1); @@ -362,8 +368,6 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil, wil_hex_dump_txrx("Rx ", DUMP_PREFIX_NONE, 32, 4, (const void *)d, sizeof(*d), false); - wil_vring_advance_head(vring, 1); - /* no extra checks if in sniffer mode */ if (ndev->type != ARPHRD_ETHER) return skb; -- 2.39.5