shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 10:58:48 +09:00
Code Issues Packages Projects Releases Wiki Activity

wifi: iwlwifi: mvm: check firmware response size

Browse Source 
[ Upstream commit 13513cec93 ]

Check the firmware response size for responses to the
memory read/write command in debugfs before using it.

Fixes: 2b55f43f8e ("iwlwifi: mvm: Add mem debugfs entry")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230417113648.0d56fcaf68ee.I70e9571f3ed7263929b04f8fabad23c9b999e4ea@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Johannes Berg
2023-04-17 11:41:33 +03:00
committed by Greg Kroah-Hartman
parent 4ff7c0fbb3
commit f4eb14d261
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
View File

@@ -1885,6 +1885,11 @@ static ssize_t iwl_dbgfs_mem_read(struct file *file, char __user *user_buf,
if (ret < 0) if (ret < 0)
return ret; return ret;
if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
ret = -EIO;
goto out;
}
rsp = (void *)hcmd.resp_pkt->data; rsp = (void *)hcmd.resp_pkt->data;
if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) { if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) {
ret = -ENXIO; ret = -ENXIO;
@@ -1962,6 +1967,11 @@ static ssize_t iwl_dbgfs_mem_write(struct file *file,
if (ret < 0) if (ret < 0)
return ret; return ret;
if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) {
ret = -EIO;
goto out;
}
rsp = (void *)hcmd.resp_pkt->data; rsp = (void *)hcmd.resp_pkt->data;
if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) { if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) {
ret = -ENXIO; ret = -ENXIO;