[PATCH] ath11k: Add sanity check in htt pktlog

* [PATCH] ath11k: Add sanity check in htt pktlog
@ 2019-05-10 10:19 Anilkumar Kolli
  2019-05-13 14:52 ` Kalle Valo
  0 siblings, 1 reply; 2+ messages in thread
From: Anilkumar Kolli @ 2019-05-10 10:19 UTC (permalink / raw)
  To: ath11k

Add sanity check before processing pktlog buffer.

Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org>
---
 drivers/net/wireless/ath/ath11k/debug.h | 2 ++
 drivers/net/wireless/ath/ath11k/dp_rx.c | 9 +++++++++
 2 files changed, 11 insertions(+)

diff --git a/drivers/net/wireless/ath/ath11k/debug.h b/drivers/net/wireless/ath/ath11k/debug.h
index e51235f62536..13973d972169 100644
--- a/drivers/net/wireless/ath/ath11k/debug.h
+++ b/drivers/net/wireless/ath/ath11k/debug.h
@@ -68,6 +68,8 @@ struct debug_htt_stats_req {
 
 #define ATH11K_FW_STATS_BUF_SIZE (1024 * 1024)
 
+#define ATH11K_HTT_PKTLOG_MAX_SIZE 2048
+
 enum ath11k_pktlog_filter {
 	ATH11K_PKTLOG_RX		= 0x000000001,
 	ATH11K_PKTLOG_TX		= 0x000000002,
diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c
index 0796f3ba8333..c7582ce08899 100644
--- a/drivers/net/wireless/ath/ath11k/dp_rx.c
+++ b/drivers/net/wireless/ath/ath11k/dp_rx.c
@@ -1072,6 +1072,15 @@ static void ath11k_htt_pktlog(struct ath11k_base *ab,
 	u8 pdev_id;
 
 	len = FIELD_GET(HTT_T2H_PPDU_STATS_PAYLOAD_SIZE_M, *data);
+
+	if (len > ATH11K_HTT_PKTLOG_MAX_SIZE)
+	{
+		ath11k_warn(ab, "htt pktlog buffer size %d, expected < %d\n",
+			    len,
+			    ATH11K_HTT_PKTLOG_MAX_SIZE);
+		return;
+	}
+
 	pdev_id = FIELD_GET(HTT_T2H_PPDU_STATS_PDEV_ID_M, *data);
 	pdev_id = DP_HW2SW_MACID(pdev_id);
 	ar = ab->pdevs[pdev_id].ar;
-- 
1.9.1


_______________________________________________
ath11k mailing list
ath11k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath11k

^ permalink raw reply related	[flat|nested] 2+ messages in thread