wifi: iwlwifi: mld: don't parse a notif before checking its length

In order to compure the size of the iwl_mcc_update_resp which has a
variable length, we need to know the number of channels.
In order to read the number of channels, we must first check the
payload is long enough to read at least that.

Add this check.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.c2f644919011.Ic579e9935b92a674c96ccc44713140b5b4bc5d10@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mld/mcc.c b/drivers/net/wireless/intel/iwlwifi/mld/mcc.c
index 8502129abe49398999cf8c2b13d0e7e3ff55336a..830c251f43afccdf1acca3e0f605f8f945421d36 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mld/mcc.c
+++ b/drivers/net/wireless/intel/iwlwifi/mld/mcc.c
@@ -18,9 +18,15 @@ static struct iwl_mcc_update_resp_v8 *
 iwl_mld_copy_mcc_resp(const struct iwl_rx_packet *pkt)
 {
        const struct iwl_mcc_update_resp_v8 *mcc_resp_v8 = (const void *)pkt->data;
-       int n_channels = __le32_to_cpu(mcc_resp_v8->n_channels);
        struct iwl_mcc_update_resp_v8 *resp_cp;
-       int notif_len = struct_size(resp_cp, channels, n_channels);
+       int n_channels;
+       int notif_len;
+
+       if (iwl_rx_packet_payload_len(pkt) < sizeof(*mcc_resp_v8))
+               return ERR_PTR(-EINVAL);
+
+       n_channels = __le32_to_cpu(mcc_resp_v8->n_channels);
+       notif_len = struct_size(resp_cp, channels, n_channels);
 
        if (iwl_rx_packet_payload_len(pkt) != notif_len)
                return ERR_PTR(-EINVAL);