averello/linux-stable-mirror
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2026-09-22 09:34:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

wifi: iwlwifi: mvm: validate SAR GEO response payload size

Browse Source 
[ Upstream commit 408d7da382 ]

The SAR GEO command response is cast to
iwl_geo_tx_power_profiles_resp without verifying the payload length.
A malformed or unexpected firmware response can lead to reading an
invalid structure layout.

Add an explicit size check before accessing the response data and
return -EIO when the payload size is wrong.

Fixes: f604324eef ("iwlwifi: remove iwl_validate_sar_geo_profile() export")
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.7e749b7d374a.I4ef54548bff6c6e7c7a57bee771ac12508aad677@changeid
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Pagadala Yesu Anjaneyulu
2026-08-03 11:15:18 +02:00
committed by Greg Kroah-Hartman
parent 42a82b509a
commit dafd46a720
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+10
View File
@@ -908,12 +908,22 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
return ret;
}
if (IWL_FW_CHECK(mvm,
iwl_rx_packet_payload_len(cmd.resp_pkt) !=
sizeof(*resp),
"Wrong size for iwl_geo_tx_power_profiles_resp: %d\n",
iwl_rx_packet_payload_len(cmd.resp_pkt))) {
ret = -EIO;
goto out;
}
resp = (void *)cmd.resp_pkt->data;
ret = le32_to_cpu(resp->profile_idx);
if (WARN_ON(ret > ACPI_NUM_GEO_PROFILES_REV3))
ret = -EIO;
out:
iwl_free_resp(&cmd);
return ret;
}