[PATCH rtw-next 2/3] wifi: rtw89: wow: check AOAC report C2H event length

[Ping-Ke Shih <pkshih@realtek.com>]

From: Chih-Kang Chang <gary.chang@realtek.com>

The AOAC report C2H event contains fixed-size fields including GTK
and IGTK. The received C2H skb may contain less data than the expected
AOAC report size.

Check the skb length before processing the AOAC report to ensure the
complete report is available.

Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
---
 drivers/net/wireless/realtek/rtw89/mac.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/wireless/realtek/rtw89/mac.c b/drivers/net/wireless/realtek/rtw89/mac.c
index 093291e8854d..ad849e4b4a50 100644
--- a/drivers/net/wireless/realtek/rtw89/mac.c
+++ b/drivers/net/wireless/realtek/rtw89/mac.c
@@ -5897,6 +5897,13 @@ rtw89_mac_c2h_wow_aoac_rpt(struct rtw89_dev *rtwdev, struct sk_buff *skb, u32 le
 		(const struct rtw89_c2h_wow_aoac_report *)skb->data;
 	struct rtw89_completion_data data = {};
 
+	if (skb->len < sizeof(*c2h)) {
+		rtw89_warn(rtwdev, "wow: aoac rpt skb len %u is too short\n",
+			   skb->len);
+		data.err = true;
+		goto out;
+	}
+
 	aoac_rpt->rpt_ver = c2h->rpt_ver;
 	aoac_rpt->sec_type = c2h->sec_type;
 	aoac_rpt->key_idx = c2h->key_idx;
@@ -5913,6 +5920,7 @@ rtw89_mac_c2h_wow_aoac_rpt(struct rtw89_dev *rtwdev, struct sk_buff *skb, u32 le
 	aoac_rpt->igtk_ipn = le64_to_cpu(c2h->igtk_ipn);
 	memcpy(aoac_rpt->igtk, c2h->igtk, sizeof(aoac_rpt->igtk));
 
+out:
 	rtw89_complete_cond(wait, RTW89_WOW_WAIT_COND_AOAC, &data);
 }
 
-- 
2.25.1