Commit 07552b9a authored by Daniel Gabay's avatar Daniel Gabay Committed by Liu Jian
Browse files

wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() 

stable inclusion
from stable-v5.10.229
commit 45a628911d3c68e024eed337054a0452b064f450
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQF
CVE: CVE-2024-53059

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=45a628911d3c68e024eed337054a0452b064f450



-------------------------------------------------

[ Upstream commit 07a6e3b78a65f4b2796a8d0d4adb1a15a81edead ]

1. The size of the response packet is not validated.
2. The response buffer is not freed.

Resolve these issues by switching to iwl_mvm_send_cmd_status(),
which handles both size validation and frees the buffer.

Fixes: f130bb75 ("iwlwifi: add FW recovery flow")
Signed-off-by: default avatarDaniel Gabay <daniel.gabay@intel.com>
Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241010140328.76c73185951e.Id3b6ca82ced2081f5ee4f33c997491d0ebda83f7@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Jian <liujian56@huawei.com>
parent f5aec775

drivers/net/wireless/intel/iwlwifi/mvm/fw.c

+4 −6
Original line number Diff line number Diff line
@@ -1261,8 +1261,8 @@ static void iwl_mvm_disconnect_iterator(void *data, u8 *mac, 
void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)

{

	u32 error_log_size = mvm->fw->ucode_capa.error_log_size;

	u32 status = 0;

	int ret;

	u32 resp;



	struct iwl_fw_error_recovery_cmd recovery_cmd = {

		.flags = cpu_to_le32(flags),
@@ -1270,7 +1270,6 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) 
	};

	struct iwl_host_cmd host_cmd = {

		.id = WIDE_ID(SYSTEM_GROUP, FW_ERROR_RECOVERY_CMD),

		.flags = CMD_WANT_SKB,

		.data = {&recovery_cmd, },

		.len = {sizeof(recovery_cmd), },

	};
@@ -1290,7 +1289,7 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) 
		recovery_cmd.buf_size = cpu_to_le32(error_log_size);

	}



	ret = iwl_mvm_send_cmd(mvm, &host_cmd);

	ret = iwl_mvm_send_cmd_status(mvm, &host_cmd, &status);

	kfree(mvm->error_recovery_buf);

	mvm->error_recovery_buf = NULL;
@@ -1301,11 +1300,10 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) 


	/* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */

	if (flags & ERROR_RECOVERY_UPDATE_DB) {

		resp = le32_to_cpu(*(__le32 *)host_cmd.resp_pkt->data);

		if (resp) {

		if (status) {

			IWL_ERR(mvm,

				"Failed to send recovery cmd blob was invalid %d\n",

				resp);

				status);



			ieee80211_iterate_interfaces(mvm->hw, 0,

						     iwl_mvm_disconnect_iterator,