github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: iwlwifi: dbg-tlv: bound aligned TLV walk length

Browse Source 
Validate ALIGN(tlv_len, 4) before advancing through external debug
TLVs to prevent parser length underflow.

Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717173215.e08d6550c6ec.Iad64190a7d5cded553aff41973120396aef1b557@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
This commit is contained in:
Emmanuel Grumbach 2026-07-17 17:33:37 +03:00 committed by Miri Korenblit
parent acad742714
commit 856ab29632
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
View File

@ -475,6 +475,7 @@ static int iwl_dbg_tlv_parse_bin(struct iwl_trans *trans, const u8 *data,
{
const struct iwl_ucode_tlv *tlv;
u32 tlv_len;
size_t aligned_tlv_len;
while (len >= sizeof(*tlv)) {
len -= sizeof(*tlv);
@ -487,8 +488,16 @@ static int iwl_dbg_tlv_parse_bin(struct iwl_trans *trans, const u8 *data,
len, tlv_len);
return -EINVAL;
}
len -= ALIGN(tlv_len, 4);
data += sizeof(*tlv) + ALIGN(tlv_len, 4);
aligned_tlv_len = ALIGN(tlv_len, 4);
if (len < aligned_tlv_len) {
IWL_ERR(trans, "invalid aligned TLV len: %zd/%zu\n",
len, aligned_tlv_len);
return -EINVAL;
}
len -= aligned_tlv_len;
data += sizeof(*tlv) + aligned_tlv_len;
iwl_dbg_tlv_alloc(trans, tlv, true);
}