Commit ccbffd69 authored by Johannes Berg's avatar Johannes Berg Committed by Luca Coelho
Browse files

iwlwifi: fix debug TLV parsing 



Debug TLV parsing was missing size checks, so if a valid but
too short TLV was encountered, it would attempt to read it.
If the firmware file was arranged to be a multiple of pages
long with this happening just before the end, it could crash
reading out-of-bounds of a vmalloc area.

Fix this by adding the relevant size check.

Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20211210110539.84848da8067f.Ifb4f80c95d283ec62e495a7928069af711b5fee2@changeid


Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent 8b0f9254

drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c

+11 −4
Original line number Diff line number Diff line
@@ -300,14 +300,21 @@ static int (*dbg_tlv_alloc[])(struct iwl_trans *trans, 
void iwl_dbg_tlv_alloc(struct iwl_trans *trans, const struct iwl_ucode_tlv *tlv,

		       bool ext)

{

	const struct iwl_fw_ini_header *hdr = (const void *)&tlv->data[0];

	u32 type = le32_to_cpu(tlv->type);

	u32 tlv_idx = type - IWL_UCODE_TLV_DEBUG_BASE;

	u32 domain = le32_to_cpu(hdr->domain);

	enum iwl_ini_cfg_state *cfg_state = ext ?

		&trans->dbg.external_ini_cfg : &trans->dbg.internal_ini_cfg;

	const struct iwl_fw_ini_header *hdr = (const void *)&tlv->data[0];

	u32 type;

	u32 tlv_idx;

	u32 domain;

	int ret;



	if (le32_to_cpu(tlv->length) < sizeof(*hdr))

		return;



	type = le32_to_cpu(tlv->type);

	tlv_idx = type - IWL_UCODE_TLV_DEBUG_BASE;

	domain = le32_to_cpu(hdr->domain);



	if (domain != IWL_FW_INI_DOMAIN_ALWAYS_ON &&

	    !(domain & trans->dbg.domains_bitmap)) {

		IWL_DEBUG_FW(trans,