lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 487/917] iwlwifi: pnvm: dont kmemdup() more than we have
    Date
    From: Johannes Berg <johannes.berg@intel.com>

    [ Upstream commit 0f892441d8c353144e3669b7991fa5fe0bd353e9 ]

    We shouldn't kmemdup() more data than we have, that might
    cause the code to crash. Fix that by updating the length
    before the kmemdup.

    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/iwlwifi.20211016114029.ab0e64c3fba9.Ic6a3295fc384750b51b4270bf0b7d94984a139f2@changeid
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 7 +++----
    1 file changed, 3 insertions(+), 4 deletions(-)

    diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
    index dde22bdc87039..9b0eee53488ab 100644
    --- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
    +++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
    @@ -284,16 +284,15 @@ int iwl_pnvm_load(struct iwl_trans *trans,
    /* First attempt to get the PNVM from BIOS */
    package = iwl_uefi_get_pnvm(trans, &len);
    if (!IS_ERR_OR_NULL(package)) {
    + /* we need only the data */
    + len -= sizeof(*package);
    data = kmemdup(package->data, len, GFP_KERNEL);

    /* free package regardless of whether kmemdup succeeded */
    kfree(package);

    - if (data) {
    - /* we need only the data size */
    - len -= sizeof(*package);
    + if (data)
    goto parse;
    - }
    }

    /* If it's not available, try from the filesystem */
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 01:10    [W:4.046 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site