[PATCH] wifi: cw1200: validate RX header before use

[PATCH] wifi: cw1200: validate RX header before use

[Pengpeng Hou]

cw1200_rx_cb() interprets frame_control and management-frame fields before
reaching its existing minimum IEEE 802.11 header check. A short firmware
frame can therefore be read before it is rejected.

Move the existing length check ahead of the first header consumer.

Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/net/wireless/st/cw1200/txrx.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/st/cw1200/txrx.c b/drivers/net/wireless/st/cw1200/txrx.c
index 084d52b11f5b0..e5435595a78f0 100644
--- a/drivers/net/wireless/st/cw1200/txrx.c
+++ b/drivers/net/wireless/st/cw1200/txrx.c
@@ -1018,6 +1018,11 @@ void cw1200_rx_cb(struct cw1200_common *priv,
 		/* STA is stopped. */
 		goto drop;
 	}
+	if (skb->len < sizeof(struct ieee80211_pspoll)) {
+		wiphy_warn(priv->hw->wiphy,
+			   "Malformed SDU rx'ed. Size is lesser than IEEE header.\n");
+		goto drop;
+	}
 
 	if (link_id && link_id <= CW1200_MAX_STA_IN_AP_MODE) {
 		entry =	&priv->link_id_db[link_id - 1];
@@ -1062,11 +1067,6 @@ void cw1200_rx_cb(struct cw1200_common *priv,
 		}
 	}
 
-	if (skb->len < sizeof(struct ieee80211_pspoll)) {
-		wiphy_warn(priv->hw->wiphy, "Malformed SDU rx'ed. Size is lesser than IEEE header.\n");
-		goto drop;
-	}
-
 	if (ieee80211_is_pspoll(frame->frame_control))
 		if (cw1200_handle_pspoll(priv, skb))
 			goto drop;

base-commit: 08dbfad3f5040f5bdb6c529da20d6d4e81fefd72
-- 
2.50.1