| 1 |
tmb |
1329221 |
From 30bc539c93e40b6afcea9aaa39de262f45ac4a63 Mon Sep 17 00:00:00 2001 |
| 2 |
|
|
From: Luca Coelho <luciano.coelho@intel.com> |
| 3 |
|
|
Date: Mon, 11 Jun 2018 11:15:17 +0300 |
| 4 |
|
|
Subject: [PATCH 029/145] iwlwifi: mvm: check for n_profiles validity in EWRD |
| 5 |
|
|
ACPI |
| 6 |
|
|
|
| 7 |
|
|
[ Upstream commit 2e1976bb75263fbad918e82184b16a23bd721546 ] |
| 8 |
|
|
|
| 9 |
|
|
When reading the profiles from the EWRD table in ACPI, we loop over |
| 10 |
|
|
the data and set it into our internal table. We use the number of |
| 11 |
|
|
profiles specified in ACPI without checking its validity, so if the |
| 12 |
|
|
ACPI table is corrupted and the number is larger than our array size, |
| 13 |
|
|
we will try to make an out-of-bounds access. |
| 14 |
|
|
|
| 15 |
|
|
Fix this by making sure the value specified in the ACPI table is |
| 16 |
|
|
valid. |
| 17 |
|
|
|
| 18 |
|
|
Fixes: 6996490501ed ("iwlwifi: mvm: add support for EWRD (Dynamic SAR) ACPI table") |
| 19 |
|
|
Signed-off-by: Luca Coelho <luciano.coelho@intel.com> |
| 20 |
|
|
Signed-off-by: Sasha Levin <sashal@kernel.org> |
| 21 |
|
|
--- |
| 22 |
|
|
drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 8 ++++++-- |
| 23 |
|
|
1 file changed, 6 insertions(+), 2 deletions(-) |
| 24 |
|
|
|
| 25 |
|
|
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c |
| 26 |
|
|
index 6bb1a99a197a..48a3611d6a31 100644 |
| 27 |
|
|
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c |
| 28 |
|
|
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c |
| 29 |
|
|
@@ -704,8 +704,12 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm) |
| 30 |
|
|
enabled = !!(wifi_pkg->package.elements[1].integer.value); |
| 31 |
|
|
n_profiles = wifi_pkg->package.elements[2].integer.value; |
| 32 |
|
|
|
| 33 |
|
|
- /* in case of BIOS bug */ |
| 34 |
|
|
- if (n_profiles <= 0) { |
| 35 |
|
|
+ /* |
| 36 |
|
|
+ * Check the validity of n_profiles. The EWRD profiles start |
| 37 |
|
|
+ * from index 1, so the maximum value allowed here is |
| 38 |
|
|
+ * ACPI_SAR_PROFILES_NUM - 1. |
| 39 |
|
|
+ */ |
| 40 |
|
|
+ if (n_profiles <= 0 || n_profiles >= ACPI_SAR_PROFILE_NUM) { |
| 41 |
|
|
ret = -EINVAL; |
| 42 |
|
|
goto out_free; |
| 43 |
|
|
} |
| 44 |
|
|
-- |
| 45 |
|
|
2.19.1 |
| 46 |
|
|
|
Parent Directory
| 
Revision Log