wifi: iwlwifi: mvm: d3: validate D3 resume notification payloads

D3 resume notification handlers read firmware notification fields
before validating that the payload contains the complete fixed structure.
This causes buffer underread on malformed or truncated notifications.

Move payload length validation to occur before any field access in:
- iwl_mvm_parse_wowlan_info_notif: validate before reading num_mlo_link_keys
- iwl_mvm_wait_d3_notif D3_END handler: validate before reading flags

Assisted-by: GitHub Copilot <copilot@github.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260714141909.762193753434.I148991b8136cc5042fa08b5faf7b57d38aa2fb47@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
index d7ceb385ae0b1e1fc2083dced3f8a12124756991..3429d9a10e42092b6bd3773084b5712527de431a 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/d3.c
@@ -2123,16 +2123,16 @@ static void iwl_mvm_parse_wowlan_info_notif(struct iwl_mvm *mvm,
                                            struct iwl_wowlan_status_data *status,
                                            u32 len)
 {
-       if (IWL_FW_CHECK(mvm, data->num_mlo_link_keys,
-                        "MLO is not supported, shouldn't receive MLO keys\n"))
-               return;
-
        if (len < sizeof(*data)) {
                IWL_ERR(mvm, "Invalid WoWLAN info notification!\n");
                status = NULL;
                return;
        }
 
+       if (IWL_FW_CHECK(mvm, data->num_mlo_link_keys,
+                        "MLO is not supported, shouldn't receive MLO keys\n"))
+               return;
+
        if (mvm->fast_resume)
                return;
 
@@ -2942,6 +2942,11 @@ static bool iwl_mvm_wait_d3_notif(struct iwl_notif_wait_data *notif_wait,
        case WIDE_ID(PROT_OFFLOAD_GROUP, D3_END_NOTIFICATION): {
                struct iwl_d3_end_notif *notif = (void *)pkt->data;
 
+               if (len < sizeof(*notif)) {
+                       IWL_ERR(mvm, "Invalid D3 end notification size\n");
+                       break;
+               }
+
                d3_data->d3_end_flags = __le32_to_cpu(notif->flags);
                d3_data->notif_received |= IWL_D3_NOTIF_D3_END_NOTIF;