DigiGoon/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()

Browse source 
[ Upstream commit 07a6e3b78a65f4b2796a8d0d4adb1a15a81edead ]

1. The size of the response packet is not validated.
2. The response buffer is not freed.

Resolve these issues by switching to iwl_mvm_send_cmd_status(),
which handles both size validation and frees the buffer.

Fixes: f130bb75d8 ("iwlwifi: add FW recovery flow")
Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241010140328.76c73185951e.Id3b6ca82ced2081f5ee4f33c997491d0ebda83f7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Daniel Gabay 2024-10-10 14:05:05 +03:00 • committed by Greg Kroah-Hartman
parent 8b30a66a94
commit 9c98ee7ea4
1 changed files with 4 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/net/wireless/intel/iwlwifi/mvm/fw.c
View file

@ -1192,8 +1192,8 @@ static void iwl_mvm_disconnect_iterator(void *data, u8 *mac,
void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags) void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)
{ {
u32 error_log_size = mvm->fw->ucode_capa.error_log_size; u32 error_log_size = mvm->fw->ucode_capa.error_log_size;
u32 status = 0;
int ret; int ret;
u32 resp;
struct iwl_fw_error_recovery_cmd recovery_cmd = { struct iwl_fw_error_recovery_cmd recovery_cmd = {
.flags = cpu_to_le32(flags), .flags = cpu_to_le32(flags),
@ -1201,7 +1201,6 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)
}; };
struct iwl_host_cmd host_cmd = { struct iwl_host_cmd host_cmd = {
.id = WIDE_ID(SYSTEM_GROUP, FW_ERROR_RECOVERY_CMD), .id = WIDE_ID(SYSTEM_GROUP, FW_ERROR_RECOVERY_CMD),
.flags = CMD_WANT_SKB,
.data = {&recovery_cmd, }, .data = {&recovery_cmd, },
.len = {sizeof(recovery_cmd), }, .len = {sizeof(recovery_cmd), },
}; };
@ -1221,7 +1220,7 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)
recovery_cmd.buf_size = cpu_to_le32(error_log_size); recovery_cmd.buf_size = cpu_to_le32(error_log_size);
} }
ret = iwl_mvm_send_cmd(mvm, &host_cmd); ret = iwl_mvm_send_cmd_status(mvm, &host_cmd, &status);
kfree(mvm->error_recovery_buf); kfree(mvm->error_recovery_buf);
mvm->error_recovery_buf = NULL; mvm->error_recovery_buf = NULL;
@ -1232,11 +1231,10 @@ void iwl_mvm_send_recovery_cmd(struct iwl_mvm *mvm, u32 flags)
/* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */ /* skb respond is only relevant in ERROR_RECOVERY_UPDATE_DB */
if (flags & ERROR_RECOVERY_UPDATE_DB) { if (flags & ERROR_RECOVERY_UPDATE_DB) {
resp = le32_to_cpu(*(__le32 *)host_cmd.resp_pkt->data); if (status) {
if (resp) {
IWL_ERR(mvm, IWL_ERR(mvm,
"Failed to send recovery cmd blob was invalid %d\n", "Failed to send recovery cmd blob was invalid %d\n",
resp); status);
ieee80211_iterate_interfaces(mvm->hw, 0, ieee80211_iterate_interfaces(mvm->hw, 0,
iwl_mvm_disconnect_iterator, iwl_mvm_disconnect_iterator,