diff options
| author | Mordechay Goodstein <mordechay.goodstein@intel.com> | 2020-04-24 18:48:11 +0300 |
|---|---|---|
| committer | Luca Coelho <luciano.coelho@intel.com> | 2020-05-08 09:50:46 +0300 |
| commit | 0c9e025e797e02c35449b3ad08d3317e5fc7d7b8 (patch) | |
| tree | a24cdde6216735d40ad0409d731853be9112aea9 /drivers/net/wireless/intel/iwlwifi/fw/api | |
| parent | f25c418dcad93755cf48537d60a46070112be72c (diff) | |
iwlwifi: yoyo: don't access TLV before verifying len
If we access the TLV memory with shorter len than the struct
we access garbage data that was not given by the user.
On the way rewrite the checker in a cleaner way.
Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20200424182644.54418c829390.I15d6b462a0e69a280b6c6cfbcb6bcb05bb5f79ee@changeid
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/fw/api')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h b/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h index b9d7ed93311c..74ac65bd545a 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h +++ b/drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h @@ -5,7 +5,7 @@ * * GPL LICENSE SUMMARY * - * Copyright (C) 2018 - 2019 Intel Corporation + * Copyright (C) 2018 - 2020 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of version 2 of the GNU General Public License as @@ -25,7 +25,7 @@ * * BSD LICENSE * - * Copyright (C) 2018 - 2019 Intel Corporation + * Copyright (C) 2018 - 2020 Intel Corporation * All rights reserved. * * Redistribution and use in source and binary forms, with or without @@ -304,6 +304,7 @@ enum iwl_fw_ini_buffer_location { IWL_FW_INI_LOCATION_SRAM_PATH, IWL_FW_INI_LOCATION_DRAM_PATH, IWL_FW_INI_LOCATION_NPK_PATH, + IWL_FW_INI_LOCATION_NUM, }; /* FW_DEBUG_TLV_BUFFER_LOCATION_E_VER_1 */ /** |