github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 10:09:10 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn

Browse Source 
iwl_pnvm_complete_fn() casts pkt->data directly to
struct iwl_pnvm_init_complete_ntfy and reads the status field
without first verifying that the firmware notification payload
is large enough to contain that structure.

Add a WARN_ON_ONCE check against sizeof(*pnvm_ntf) and return
early without reading uninitialised memory if the payload is too
short.

Fixes: b3e4c0f34c ("iwlwifi: move PNVM implementation to common code")
Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.7f2a669e5c75.I00465dcfcbccb250ae9af2d9bb305e24de1ba394@changeid
This commit is contained in:
Emmanuel Grumbach 2026-07-15 21:57:07 +03:00 committed by Miri Korenblit
parent bc796f84ec
commit daec24a5ed
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
View File

@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
* Copyright(c) 2020-2025 Intel Corporation
* Copyright(c) 2020-2026 Intel Corporation
*/
#include "iwl-drv.h"
@ -12,6 +12,7 @@
#include "fw/api/alive.h"
#include "fw/uefi.h"
#include "fw/img.h"
#include "fw/dbg.h"
#define IWL_PNVM_REDUCED_CAP_BIT BIT(25)
@ -26,6 +27,12 @@ static bool iwl_pnvm_complete_fn(struct iwl_notif_wait_data *notif_wait,
struct iwl_trans *trans = (struct iwl_trans *)data;
struct iwl_pnvm_init_complete_ntfy *pnvm_ntf = (void *)pkt->data;
if (IWL_FW_CHECK(trans,
iwl_rx_packet_payload_len(pkt) < sizeof(*pnvm_ntf),
"Bad notif len: %d\n",
iwl_rx_packet_payload_len(pkt)))
return true;
IWL_DEBUG_FW(trans,
"PNVM complete notification received with status 0x%0x\n",
le32_to_cpu(pnvm_ntf->status));