Commit c66ac778 authored by Johannes Berg's avatar Johannes Berg Committed by Zheng Yejian
Browse files

wifi: iwlwifi: dbg-tlv: ensure NUL termination 

stable inclusion
from stable-v5.10.214
commit fabe2db7de32a881e437ee69db32e0de785a6209
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9E2
CVE: CVE-2024-35845

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fabe2db7de32a881e437ee69db32e0de785a6209



--------------------------------

[ Upstream commit ea1d166fae14e05d49ffb0ea9fcd4658f8d3dcea ]

The iwl_fw_ini_debug_info_tlv is used as a string, so we must
ensure the string is terminated correctly before using it.

Fixes: a9248de4 ("iwlwifi: dbg_ini: add TLV allocation new API support")
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Reviewed-by: default avatarGregory Greenman <gregory.greenman@intel.com>
Signed-off-by: default avatarMiri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240128084842.be15e858ee89.Ibff93429cf999eafc7b26f3eef4c055dc84984a0@changeid


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZheng Yejian <zhengyejian1@huawei.com>
parent 80a0681e

drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c

+6 −0
Original line number Diff line number Diff line
@@ -155,6 +155,12 @@ static int iwl_dbg_tlv_alloc_debug_info(struct iwl_trans *trans, 
	if (le32_to_cpu(tlv->length) != sizeof(*debug_info))

		return -EINVAL;



	/* we use this as a string, ensure input was NUL terminated */

	if (strnlen(debug_info->debug_cfg_name,

		    sizeof(debug_info->debug_cfg_name)) ==

			sizeof(debug_info->debug_cfg_name))

		return -EINVAL;



	IWL_DEBUG_FW(trans, "WRT: Loading debug cfg: %s\n",

		     debug_info->debug_cfg_name);