wifi: iwlwifi: mvm: fix read in wake packet notification handler

In iwl_mvm_wowlan_store_wake_pkt(), packet_len was initialized from
notif->wake_packet_length before the explicit check that len >=
sizeof(*notif).

Move the assignment of packet_len to after the size check so that
notif->wake_packet_length is only accessed once the payload length
has been validated.

Fixes: 219ed58feda9 ("wifi: iwlwifi: mvm: Add support for wowlan wake packet notification")
Signed-off-by: Shahar Tzarfati <shahar.tzarfati@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.99d5cf85a528.Ic4aa736011d4fe88e0cd19723d1d48bb24642198@changeid

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index 3429d9a10e42092b6bd3773084b5712527de431a..4eaba0bc4a1ec74d6cc3764c7e5e15fe67df4b14 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -2756,7 +2756,7 @@ static int iwl_mvm_wowlan_store_wake_pkt(struct iwl_mvm *mvm,
                                         struct iwl_wowlan_status_data *status,
                                         u32 len)
 {
-       u32 data_size, packet_len = le32_to_cpu(notif->wake_packet_length);
+       u32 data_size, packet_len;
 
        if (len < sizeof(*notif)) {
                IWL_ERR(mvm, "Invalid WoWLAN wake packet notification!\n");
@@ -2775,6 +2775,7 @@ static int iwl_mvm_wowlan_store_wake_pkt(struct iwl_mvm *mvm,
                return -EIO;
        }
 
+       packet_len = le32_to_cpu(notif->wake_packet_length);
        data_size = len - offsetof(struct iwl_wowlan_wake_pkt_notif, wake_packet);
 
        /* data_size got the padding from the notification, remove it. */