Alexey Velichayshiy e67d8c626a wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler() ...

commit 744fabc338 upstream.

The memcpy function assumes the dynamic array notif->matches is at least
as large as the number of bytes to copy. Otherwise, results->matches may
contain unwanted data. To guarantee safety, extend the validation in one
of the checks to ensure sufficient packet length.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Cc: stable@vger.kernel.org
Fixes: 5ac54afd4d ("wifi: iwlwifi: mvm: Add handling for scan offload match info notification")
Signed-off-by: Alexey Velichayshiy <a.velichayshiy@ispras.ru>
Link: https://patch.msgid.link/20260207150335.1013646-1-a.velichayshiy@ispras.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-04-11 14:24:40 +02:00

..

ipw2x00

net: intel: fix PCI device ID conflict between i40e and ipw2200

2026-03-04 07:21:56 -05:00

iwlegacy

wifi: iwlegacy: add missing mutex protection in il3945_store_measurement()

2026-03-04 07:21:16 -05:00

iwlwifi

wifi: iwlwifi: mvm: fix potential out-of-bounds read in iwl_mvm_nd_match_info_handler()

2026-04-11 14:24:40 +02:00

Kconfig

…

Makefile

…