niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

iwlwifi: pnvm: don't kmemdup() more than we have

Browse source 
We shouldn't kmemdup() more data than we have, that might
cause the code to crash. Fix that by updating the length
before the kmemdup.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20211016114029.ab0e64c3fba9.Ic6a3295fc384750b51b4270bf0b7d94984a139f2@changeid
This commit is contained in:
Johannes Berg 2021-10-16 11:43:57 +03:00 • committed by Kalle Valo
parent 70382b0897
commit 0f892441d8
1 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
View file

@ -284,16 +284,15 @@ int iwl_pnvm_load(struct iwl_trans *trans,
/* First attempt to get the PNVM from BIOS */
package = iwl_uefi_get_pnvm(trans, &len);
if (!IS_ERR_OR_NULL(package)) {
/* we need only the data */
len -= sizeof(*package);
data = kmemdup(package->data, len, GFP_KERNEL);
/* free package regardless of whether kmemdup succeeded */
kfree(package);
if (data) {
/* we need only the data size */
len -= sizeof(*package);
if (data)
goto parse;
}
}
/* If it's not available, try from the filesystem */