From: Miri Korenblit <miriam.rachel.korenblit@intel.com>
To: johannes@sipsolutions.net
Cc: linux-wireless@vger.kernel.org,
Johannes Berg <johannes.berg@intel.com>,
Gregory Greenman <gregory.greenman@intel.com>
Subject: [PATCH 07/14] wifi: iwlwifi: dbg-tlv: ensure NUL termination
Date: Sun, 28 Jan 2024 08:53:53 +0200 [thread overview]
Message-ID: <20240128084842.be15e858ee89.Ibff93429cf999eafc7b26f3eef4c055dc84984a0@changeid> (raw)
In-Reply-To: <20240128065400.2550604-1-miriam.rachel.korenblit@intel.com>
From: Johannes Berg <johannes.berg@intel.com>
The iwl_fw_ini_debug_info_tlv is used as a string, so we must
ensure the string is terminated correctly before using it.
Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
---
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index 989b100ce6ab..6cfcf1c14eaf 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -104,6 +104,12 @@ static int iwl_dbg_tlv_alloc_debug_info(struct iwl_trans *trans,
if (le32_to_cpu(tlv->length) != sizeof(*debug_info))
return -EINVAL;
+ /* we use this as a string, ensure input was NUL terminated */
+ if (strnlen(debug_info->debug_cfg_name,
+ sizeof(debug_info->debug_cfg_name)) ==
+ sizeof(debug_info->debug_cfg_name))
+ return -EINVAL;
+
IWL_DEBUG_FW(trans, "WRT: Loading debug cfg: %s\n",
debug_info->debug_cfg_name);
--
2.34.1
next prev parent reply other threads:[~2024-01-28 6:54 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-28 6:53 [PATCH 00/14] wifi: iwlwifi: updates - 2024-01-28 Miri Korenblit
2024-01-28 6:53 ` [PATCH 01/14] wifi: iwlwifi: disable eSR when BT is active Miri Korenblit
2024-01-28 6:53 ` [PATCH 02/14] wifi: iwlwifi: mvm: report beacon protection failures Miri Korenblit
2024-01-28 6:53 ` [PATCH 03/14] wifi: iwlwifi: mvm: d3: disconnect on GTK rekey failure Miri Korenblit
2024-01-28 6:53 ` [PATCH 04/14] wifi: iwlwifi: fix some kernel-doc issues Miri Korenblit
2024-01-28 6:53 ` [PATCH 05/14] wifi: iwlwifi: dbg-tlv: avoid extra allocation/copy Miri Korenblit
2024-01-28 6:53 ` [PATCH 06/14] wifi: iwlwifi: dbg-tlv: use struct_size() for allocation Miri Korenblit
2024-01-28 6:53 ` Miri Korenblit [this message]
2024-01-28 6:53 ` [PATCH 08/14] wifi: iwlwifi: fw: dbg: ensure correct config name sizes Miri Korenblit
2024-01-28 6:53 ` [PATCH 09/14] wifi: iwlwifi: acpi: fix WPFC reading Miri Korenblit
2024-01-28 6:53 ` [PATCH 10/14] wifi: iwlwifi: mvm: disconnect station vifs if recovery failed Miri Korenblit
2024-01-28 6:53 ` [PATCH 11/14] wifi: iwlwifi: mvm: fix a battery life regression Miri Korenblit
2024-01-28 6:53 ` [PATCH 12/14] wifi: iwlwifi: mvm: initialize rates in FW earlier Miri Korenblit
2024-01-28 6:53 ` [PATCH 13/14] wifi: iwlwifi: implement GLAI ACPI table loading Miri Korenblit
2024-01-28 6:54 ` [PATCH 14/14] wifi: iwlwifi: cleanup uefi variables loading Miri Korenblit
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240128084842.be15e858ee89.Ibff93429cf999eafc7b26f3eef4c055dc84984a0@changeid \
--to=miriam.rachel.korenblit@intel.com \
--cc=gregory.greenman@intel.com \
--cc=johannes.berg@intel.com \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.