| Message ID | 1557483559-15843-1-git-send-email-akolli@codeaurora.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 65ab8594d0cf26d1378bd8d040e93a393c446d95 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | ath11k: Add sanity check in htt pktlog | expand |
Anilkumar Kolli <akolli@codeaurora.org> wrote: > Add sanity check before processing pktlog buffer. > > Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org> Patch applied to ath.git, thanks. 65ab8594d0cf ath11k: Add sanity check in htt pktlog
diff --git a/drivers/net/wireless/ath/ath11k/debug.h b/drivers/net/wireless/ath/ath11k/debug.h index e51235f62536..13973d972169 100644 --- a/drivers/net/wireless/ath/ath11k/debug.h +++ b/drivers/net/wireless/ath/ath11k/debug.h @@ -68,6 +68,8 @@ struct debug_htt_stats_req { #define ATH11K_FW_STATS_BUF_SIZE (1024 * 1024) +#define ATH11K_HTT_PKTLOG_MAX_SIZE 2048 + enum ath11k_pktlog_filter { ATH11K_PKTLOG_RX = 0x000000001, ATH11K_PKTLOG_TX = 0x000000002, diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index 0796f3ba8333..c7582ce08899 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -1072,6 +1072,15 @@ static void ath11k_htt_pktlog(struct ath11k_base *ab, u8 pdev_id; len = FIELD_GET(HTT_T2H_PPDU_STATS_PAYLOAD_SIZE_M, *data); + + if (len > ATH11K_HTT_PKTLOG_MAX_SIZE) + { + ath11k_warn(ab, "htt pktlog buffer size %d, expected < %d\n", + len, + ATH11K_HTT_PKTLOG_MAX_SIZE); + return; + } + pdev_id = FIELD_GET(HTT_T2H_PPDU_STATS_PDEV_ID_M, *data); pdev_id = DP_HW2SW_MACID(pdev_id); ar = ab->pdevs[pdev_id].ar;
Add sanity check before processing pktlog buffer. Signed-off-by: Anilkumar Kolli <akolli@codeaurora.org> --- drivers/net/wireless/ath/ath11k/debug.h | 2 ++ drivers/net/wireless/ath/ath11k/dp_rx.c | 9 +++++++++ 2 files changed, 11 insertions(+)