diff options
| author | Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 2026-07-15 21:57:10 +0300 |
|---|---|---|
| committer | Miri Korenblit <miriam.rachel.korenblit@intel.com> | 2026-07-16 21:12:19 +0300 |
| commit | 7b271df210848e8d0dd9c0d7b032050b3f3affbf (patch) | |
| tree | b6769696d1e24d6e280d7dac774d403ac54379ba /include/linux/debugobjects.h | |
| parent | 7455ba7b4d6d869e337db063c466033cf9392fb5 (diff) | |
wifi: iwlwifi: pcie: validate FW section counts in iwl_pcie_init_fw_sec
iwl_pcie_init_fw_sec() iterates over LMAC, UMAC, and paging
firmware sections and writes to ctxt_dram->lmac_img[i],
ctxt_dram->umac_img[i], and ctxt_dram->virtual_img[i] without
first verifying that the counts derived from the firmware image
do not exceed the array size. An oversized firmware image could
cause out-of-bounds writes into the fixed-size context-info DRAM
arrays.
Add explicit WARN_ON checks for all three section counts and
return -EINVAL if any is exceeded.
Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.34db46ca12f3.I1aa225492a62f25293c147aa7293afa80a5d4215@changeid
Diffstat (limited to 'include/linux/debugobjects.h')
0 files changed, 0 insertions, 0 deletions