diff options
| author | Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 2026-07-17 17:33:37 +0300 |
|---|---|---|
| committer | Miri Korenblit <miriam.rachel.korenblit@intel.com> | 2026-07-18 22:37:38 +0300 |
| commit | 856ab29632c507d51d7bfe86100389d05d4d9a7f (patch) | |
| tree | c63f43ebad44f62624745b1f17b7f06c394c59b3 /drivers/net/wireless/intel/iwlwifi | |
| parent | acad742714bdc70e7fd7f234323807c596828213 (diff) | |
| download | linux-next-856ab29632c507d51d7bfe86100389d05d4d9a7f.tar.gz linux-next-856ab29632c507d51d7bfe86100389d05d4d9a7f.zip | |
wifi: iwlwifi: dbg-tlv: bound aligned TLV walk length
Validate ALIGN(tlv_len, 4) before advancing through external debug
TLVs to prevent parser length underflow.
Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717173215.e08d6550c6ec.Iad64190a7d5cded553aff41973120396aef1b557@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c index d021b24d04d6..b1a55909f0d4 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c @@ -475,6 +475,7 @@ static int iwl_dbg_tlv_parse_bin(struct iwl_trans *trans, const u8 *data, { const struct iwl_ucode_tlv *tlv; u32 tlv_len; + size_t aligned_tlv_len; while (len >= sizeof(*tlv)) { len -= sizeof(*tlv); @@ -487,8 +488,16 @@ static int iwl_dbg_tlv_parse_bin(struct iwl_trans *trans, const u8 *data, len, tlv_len); return -EINVAL; } - len -= ALIGN(tlv_len, 4); - data += sizeof(*tlv) + ALIGN(tlv_len, 4); + + aligned_tlv_len = ALIGN(tlv_len, 4); + if (len < aligned_tlv_len) { + IWL_ERR(trans, "invalid aligned TLV len: %zd/%zu\n", + len, aligned_tlv_len); + return -EINVAL; + } + + len -= aligned_tlv_len; + data += sizeof(*tlv) + aligned_tlv_len; iwl_dbg_tlv_alloc(trans, tlv, true); } |