diff options
| author |   Shahar S Matityahu <shahar.s.matityahu@intel.com> | 2019-03-20 17:41:16 +0200 |
|---|---|---|
| committer |   Luca Coelho <luciano.coelho@intel.com> | 2019-04-18 14:07:39 +0300 |
| commit | b35f63972c5c67fc0f908286f7fc624137788876 (patch) | |
| tree | c1802c3184a1ed608fc7330742a852deef6af6e8 /drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | |
| parent | iwlwifi: mvm: don't attempt debug collection in rfkill (diff) | |
| download | linux-dev-b35f63972c5c67fc0f908286f7fc624137788876.tar.xz linux-dev-b35f63972c5c67fc0f908286f7fc624137788876.zip | |
iwlwifi: dbg_ini: check debug TLV type explicitly
In ini debug TLVs bit 24 is set. The driver relies on it in the memory
allocation for the debug configuration. This implementation is
problematic in case of a new debug TLV that is not supported yet is added
and uses bit 24. In such a scenario the driver allocate space without
using it which causes errors in the apply point enabling flow.
Solve it by explicitly checking if a given TLV is part of the list of
the supported ini debug TLVs.
Signed-off-by: Shahar S Matityahu <shahar.s.matityahu@intel.com>
Fixes: f14cda6f3b31 ("iwlwifi: trans: parse and store debug ini TLVs")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c')
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c index 5798f434f68f..c7070760a10a 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c @@ -126,7 +126,8 @@ void iwl_alloc_dbg_tlv(struct iwl_trans *trans, size_t len, const u8 *data, len -= ALIGN(tlv_len, 4); data += sizeof(*tlv) + ALIGN(tlv_len, 4); - if (!(tlv_type & IWL_UCODE_INI_TLV_GROUP)) + if (tlv_type < IWL_UCODE_TLV_DEBUG_BASE || + tlv_type > IWL_UCODE_TLV_DEBUG_MAX) continue; hdr = (void *)&tlv->data[0]; |