]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()
authorAlexey Velichayshiy <a.velichayshiy@ispras.ru>
Sat, 7 Feb 2026 15:03:22 +0000 (18:03 +0300)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 24 Mar 2026 15:03:48 +0000 (16:03 +0100)
commit744fabc338e87b95c4d1ff7c95bc8c0f834c6d99
tree979fea79e60ab8f2cb54b5082ab209ad3ce16acc
parent6525a549ecba71e3c48a68a5250da830cf9db2cc
wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()

The memcpy function assumes the dynamic array notif->matches is at least
as large as the number of bytes to copy. Otherwise, results->matches may
contain unwanted data. To guarantee safety, extend the validation in one
of the checks to ensure sufficient packet length.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Cc: stable@vger.kernel.org
Fixes: 5ac54afd4d97 ("wifi: iwlwifi: mvm: Add handling for scan offload match info notification")
Signed-off-by: Alexey Velichayshiy <a.velichayshiy@ispras.ru>
Link: https://patch.msgid.link/20260207150335.1013646-1-a.velichayshiy@ispras.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/intel/iwlwifi/mvm/d3.c