mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-16 16:01:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

wifi: iwlwifi: acpi: check the size of the ACPI PPAG tables

Browse Source 
We need to make sure we don't have a buffer overflow while reading the
PPAG tables from ACPI into the firmware runtime object.
Add an ACPI specific define for the number of chains in order to
decouple the ACPI layout from the other objects.

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260319110722.451808698662.I91234c8a662608674679ce490b51be792332cd43@changeid
This commit is contained in:
Emmanuel Grumbach
2026-03-19 11:09:26 +02:00
committed by Miri Korenblit
parent 442c707c3c
commit feb27e5abb
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/net/wireless/intel/iwlwifi/fw/acpi.c
View File

@@ -951,6 +951,15 @@ int iwl_acpi_get_ppag_table(struct iwl_fw_runtime *fwrt)
goto out_free;
read_table:
if (WARN_ON_ONCE(num_sub_bands >
ARRAY_SIZE(fwrt->ppag_chains[0].subbands))) {
ret = -EINVAL;
goto out_free;
}
BUILD_BUG_ON(ACPI_PPAG_NUM_CHAINS >
ARRAY_SIZE(fwrt->ppag_chains));
fwrt->ppag_bios_rev = tbl_rev;
flags = &wifi_pkg->package.elements[1];
@@ -967,7 +976,7 @@ int iwl_acpi_get_ppag_table(struct iwl_fw_runtime *fwrt)
* first sub-band (j=0) corresponds to Low-Band (2.4GHz), and the
* following sub-bands to High-Band (5GHz).
*/
for (i = 0; i < IWL_NUM_CHAIN_LIMITS; i++) {
for (i = 0; i < ACPI_PPAG_NUM_CHAINS; i++) {
for (j = 0; j < num_sub_bands; j++) {
union acpi_object *ent;

5
drivers/net/wireless/intel/iwlwifi/fw/acpi.h
View File

@@ -96,9 +96,10 @@
*/
#define ACPI_WTAS_WIFI_DATA_SIZE (3 + IWL_WTAS_BLACK_LIST_MAX)
#define ACPI_PPAG_WIFI_DATA_SIZE_V1 ((IWL_NUM_CHAIN_LIMITS * \
#define ACPI_PPAG_NUM_CHAINS 2
#define ACPI_PPAG_WIFI_DATA_SIZE_V1 ((ACPI_PPAG_NUM_CHAINS * \
IWL_NUM_SUB_BANDS_V1) + 2)
#define ACPI_PPAG_WIFI_DATA_SIZE_V2 ((IWL_NUM_CHAIN_LIMITS * \
#define ACPI_PPAG_WIFI_DATA_SIZE_V2 ((ACPI_PPAG_NUM_CHAINS * \
IWL_NUM_SUB_BANDS_V2) + 2)
#define IWL_SAR_ENABLE_MSK BIT(0)