From: Andrei Otcheretianski Date: Mon, 15 Apr 2019 13:45:04 +0000 (+0300) Subject: iwlwifi: mvm: Drop large non sta frames X-Git-Tag: v5.3-rc1~140^2~52^2~1^2~17 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=ac70499ee97231a418dc1a4d6c9dc102e8f64631;p=thirdparty%2Fkernel%2Flinux.git iwlwifi: mvm: Drop large non sta frames In some buggy scenarios we could possible attempt to transmit frames larger than maximum MSDU size. Since our devices don't know how to handle this, it may result in asserts, hangs etc. This can happen, for example, when we receive a large multicast frame and try to transmit it back to the air in AP mode. Since in a legal scenario this should never happen, drop such frames and warn about it. Signed-off-by: Andrei Otcheretianski Signed-off-by: Luca Coelho --- diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c index 16f7458e2e81d..a3e5d88f1c07c 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c @@ -726,6 +726,9 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb) memcpy(&info, skb->cb, sizeof(info)); + if (WARN_ON_ONCE(skb->len > IEEE80211_MAX_DATA_LEN + hdrlen)) + return -1; + if (WARN_ON_ONCE(info.flags & IEEE80211_TX_CTL_AMPDU)) return -1;