Commit 3c8aaaa7 authored by Dmitry Antipov's avatar Dmitry Antipov Committed by Johannes Berg
Browse files

wifi: iwlwifi: check for kmemdup() return value in iwl_parse_tlv_firmware() 



In 'iwl_parse_tlv_firmware()', check for 'kmemdup()' return value
when handling IWL_UCODE_TLV_CURRENT_PC and set the number of parsed
entries only if an allocation was successful (just like it does with
handling IWL_UCODE_TLV_CMD_VERSIONS above). Compile tested only.

Signed-off-by: default avatarDmitry Antipov <dmantipov@yandex.ru>
Acked-by: default avatarGregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20231009170453.149905-1-dmantipov@yandex.ru


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 89141f96

drivers/net/wireless/intel/iwlwifi/iwl-drv.c

+4 −2
Original line number Diff line number Diff line
@@ -1303,10 +1303,12 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv, 
		case IWL_UCODE_TLV_CURRENT_PC:

			if (tlv_len < sizeof(struct iwl_pc_data))

				goto invalid_tlv_len;

			drv->trans->dbg.num_pc =

				tlv_len / sizeof(struct iwl_pc_data);

			drv->trans->dbg.pc_data =

				kmemdup(tlv_data, tlv_len, GFP_KERNEL);

			if (!drv->trans->dbg.pc_data)

				return -ENOMEM;

			drv->trans->dbg.num_pc =

				tlv_len / sizeof(struct iwl_pc_data);

			break;

		default:

			IWL_DEBUG_INFO(drv, "unknown TLV: %d\n", tlv_type);