diff options
| author | Emmanuel Grumbach <emmanuel.grumbach@intel.com> | 2026-07-15 21:57:07 +0300 |
|---|---|---|
| committer | Miri Korenblit <miriam.rachel.korenblit@intel.com> | 2026-07-16 21:12:18 +0300 |
| commit | daec24a5ed5da77a108e246ad77aa8b889911f93 (patch) | |
| tree | 53301a060be213e7331afac9fff529bca598521f /include/linux/timerqueue_types.h | |
| parent | bc796f84ec9a95b356959ec7caf1d4fce33f3a76 (diff) | |
wifi: iwlwifi: validate payload length in iwl_pnvm_complete_fn
iwl_pnvm_complete_fn() casts pkt->data directly to
struct iwl_pnvm_init_complete_ntfy and reads the status field
without first verifying that the firmware notification payload
is large enough to contain that structure.
Add a WARN_ON_ONCE check against sizeof(*pnvm_ntf) and return
early without reading uninitialised memory if the payload is too
short.
Fixes: b3e4c0f34c17 ("iwlwifi: move PNVM implementation to common code")
Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.7f2a669e5c75.I00465dcfcbccb250ae9af2d9bb305e24de1ba394@changeid
Diffstat (limited to 'include/linux/timerqueue_types.h')
0 files changed, 0 insertions, 0 deletions