Commit 0f892441 authored by Johannes Berg's avatar Johannes Berg Committed by Kalle Valo
Browse files

iwlwifi: pnvm: don't kmemdup() more than we have 



We shouldn't kmemdup() more data than we have, that might
cause the code to crash. Fix that by updating the length
before the kmemdup.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/iwlwifi.20211016114029.ab0e64c3fba9.Ic6a3295fc384750b51b4270bf0b7d94984a139f2@changeid
parent 70382b08

drivers/net/wireless/intel/iwlwifi/fw/pnvm.c

+3 −4
Original line number Diff line number Diff line
@@ -284,17 +284,16 @@ int iwl_pnvm_load(struct iwl_trans *trans, 
	/* First attempt to get the PNVM from BIOS */

	package = iwl_uefi_get_pnvm(trans, &len);

	if (!IS_ERR_OR_NULL(package)) {

		/* we need only the data */

		len -= sizeof(*package);

		data = kmemdup(package->data, len, GFP_KERNEL);



		/* free package regardless of whether kmemdup succeeded */

		kfree(package);



		if (data) {

			/* we need only the data size */

			len -= sizeof(*package);

		if (data)

			goto parse;

	}

	}



	/* If it's not available, try from the filesystem */

	ret = iwl_pnvm_get_from_fs(trans, &data, &len);