github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: iwlwifi: validate SEC_RT TLV minimum size

Browse Source 
Reject firmware section TLVs that are shorter than the offset field
before subtracting sizeof(offset) from the section size.

This prevents size underflow for malformed TLVs.

Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717173215.17b040b27edc.I6b32d1e9ad707417e2e604f08a63582456209372@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
This commit is contained in:
Emmanuel Grumbach 2026-07-17 17:33:40 +03:00 committed by Miri Korenblit
parent 9ba1e0a406
commit d13d5d299c
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/intel/iwlwifi/iwl-drv.c
View File

@ -492,7 +492,7 @@ static void set_sec_offset(struct iwl_firmware_pieces *pieces,
* Gets uCode section from tlv.
*/
static int iwl_store_ucode_sec(struct fw_img_parsing *img,
const void *data, int size)
const void *data, size_t size)
{
struct fw_sec *sec;
const struct fw_sec_parsing *sec_parse;
@ -501,6 +501,9 @@ static int iwl_store_ucode_sec(struct fw_img_parsing *img,
if (WARN_ON(!img || !data))
return -EINVAL;
if (size < sizeof(sec_parse->offset))
return -EINVAL;
sec_parse = (const struct fw_sec_parsing *)data;
alloc_size = sizeof(*img->sec) * (img->sec_counter + 1);