lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 488/917] iwlwifi: pnvm: read EFI data only if long enough
    Date
    From: Johannes Berg <johannes.berg@intel.com>

    [ Upstream commit e864a77f51d0d8113b49cf7d030bc9dc911c8176 ]

    If the data we get from EFI is not even long enough for
    the package struct we expect then ignore it entirely.

    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Fixes: a1a6a4cf49ec ("iwlwifi: pnvm: implement reading PNVM from UEFI")
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/iwlwifi.20211016114029.33feba783518.I54a5cf33975d0330792b3d208b225d479e168f32@changeid
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 10 +++++++---
    1 file changed, 7 insertions(+), 3 deletions(-)

    diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
    index 9b0eee53488ab..069fcbc46d2ba 100644
    --- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
    +++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
    @@ -284,9 +284,13 @@ int iwl_pnvm_load(struct iwl_trans *trans,
    /* First attempt to get the PNVM from BIOS */
    package = iwl_uefi_get_pnvm(trans, &len);
    if (!IS_ERR_OR_NULL(package)) {
    - /* we need only the data */
    - len -= sizeof(*package);
    - data = kmemdup(package->data, len, GFP_KERNEL);
    + if (len >= sizeof(*package)) {
    + /* we need only the data */
    + len -= sizeof(*package);
    + data = kmemdup(package->data, len, GFP_KERNEL);
    + } else {
    + data = NULL;
    + }

    /* free package regardless of whether kmemdup succeeded */
    kfree(package);
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 01:11    [W:4.026 / U:0.148 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site