MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-07-07 18:05:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

wifi: iwlwifi: check for kmemdup() return value in iwl_parse_tlv_firmware()

Browse Source 
[ Upstream commit 3c8aaaa755 ]

In 'iwl_parse_tlv_firmware()', check for 'kmemdup()' return value
when handling IWL_UCODE_TLV_CURRENT_PC and set the number of parsed
entries only if an allocation was successful (just like it does with
handling IWL_UCODE_TLV_CMD_VERSIONS above). Compile tested only.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20231009170453.149905-1-dmantipov@yandex.ru
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Dmitry Antipov 2023-10-09 20:04:49 +03:00 committed by Greg Kroah-Hartman
parent 0a1a3c11fc
commit 3081947105
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/wireless/intel/iwlwifi/iwl-drv.c
View File

@ -1304,10 +1304,12 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
case IWL_UCODE_TLV_CURRENT_PC: case IWL_UCODE_TLV_CURRENT_PC:
if (tlv_len < sizeof(struct iwl_pc_data)) if (tlv_len < sizeof(struct iwl_pc_data))
goto invalid_tlv_len; goto invalid_tlv_len;
drv->trans->dbg.num_pc =
tlv_len / sizeof(struct iwl_pc_data);
drv->trans->dbg.pc_data = drv->trans->dbg.pc_data =
kmemdup(tlv_data, tlv_len, GFP_KERNEL); kmemdup(tlv_data, tlv_len, GFP_KERNEL);
if (!drv->trans->dbg.pc_data)
return -ENOMEM;
drv->trans->dbg.num_pc =
tlv_len / sizeof(struct iwl_pc_data);
break; break;
default: default:
IWL_DEBUG_INFO(drv, "unknown TLV: %d\n", tlv_type); IWL_DEBUG_INFO(drv, "unknown TLV: %d\n", tlv_type);