]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()
authorDaniel Gabay <daniel.gabay@intel.com>
Thu, 10 Oct 2024 11:05:05 +0000 (14:05 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 8 Nov 2024 15:25:52 +0000 (16:25 +0100)
commit3f45d590ccbae6dfd6faef54efe74c30bd85d3da
tree692702365416383ec39ea467c02af6ecd61df9a3
parentdaa426f19aad7924690c26e76500ddad3f484d9f
wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd()

[ Upstream commit 07a6e3b78a65f4b2796a8d0d4adb1a15a81edead ]

1. The size of the response packet is not validated.
2. The response buffer is not freed.

Resolve these issues by switching to iwl_mvm_send_cmd_status(),
which handles both size validation and frees the buffer.

Fixes: f130bb75d881 ("iwlwifi: add FW recovery flow")
Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241010140328.76c73185951e.Id3b6ca82ced2081f5ee4f33c997491d0ebda83f7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/intel/iwlwifi/mvm/fw.c