From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F60BC76186 for ; Wed, 24 Jul 2019 20:16:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 28CEC205F4 for ; Wed, 24 Jul 2019 20:16:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1563999383; bh=NkOFcZC2PgZUR4KhHo7KyRrdAihdcVMOUfRME/GuUuQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=07pOO1L4V8LuGz1c8nCqvH3LwOutjCrk98/QEULvIHG7kj9N4prfah+luNEzrXPME hfWaU6lXBph7Qtw84mrqs9ImfR/qs4E+b/Xqk510u7jgyl7RhRv+84f0ZjGzOUyfjW gqT8C5HNDRzbWFjEl3XpTT44OvnNp+0x2Glbg9Rk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2404025AbfGXTvf (ORCPT ); Wed, 24 Jul 2019 15:51:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:60992 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2404021AbfGXTvf (ORCPT ); Wed, 24 Jul 2019 15:51:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5A577205C9; Wed, 24 Jul 2019 19:51:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1563997894; bh=NkOFcZC2PgZUR4KhHo7KyRrdAihdcVMOUfRME/GuUuQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YywIXPwFDua1IEPHfZjBH2AW2I/65fECL1Qwb+Ewp/L/mJTZSkwdhESrcsboVRTWP egUk27Il4dMxp3X4fAd6lytZUq0wclEjrJQ2hMyTjR7LyeVT1Dj1RSht+ajAkXJKj6 6KSKpVJxDiqmUbXx73eLCLdufd9QYZZNOXs1jIE4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrei Otcheretianski , Luca Coelho , Sasha Levin Subject: [PATCH 5.1 181/371] iwlwifi: mvm: Drop large non sta frames Date: Wed, 24 Jul 2019 21:18:53 +0200 Message-Id: <20190724191738.777272214@linuxfoundation.org> X-Mailer: git-send-email 2.22.0 In-Reply-To: <20190724191724.382593077@linuxfoundation.org> References: <20190724191724.382593077@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org [ Upstream commit ac70499ee97231a418dc1a4d6c9dc102e8f64631 ] In some buggy scenarios we could possible attempt to transmit frames larger than maximum MSDU size. Since our devices don't know how to handle this, it may result in asserts, hangs etc. This can happen, for example, when we receive a large multicast frame and try to transmit it back to the air in AP mode. Since in a legal scenario this should never happen, drop such frames and warn about it. Signed-off-by: Andrei Otcheretianski Signed-off-by: Luca Coelho Signed-off-by: Sasha Levin --- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c index 0c2aabc842f9..96f8d38ea321 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c @@ -726,6 +726,9 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb) memcpy(&info, skb->cb, sizeof(info)); + if (WARN_ON_ONCE(skb->len > IEEE80211_MAX_DATA_LEN + hdrlen)) + return -1; + if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU)) return -1; -- 2.20.1