wifi: iwlwifi: acpi: fix WPFC reading

[ Upstream commit 296f3e926716ded8dc29e349d2b042b362f96515 ]

The code reading the WPFC table needs to take into account
the domain type (first element in the package), shouldn't
leak the memory if it fails, and has a bad comment. Fix all
these issues.

Fixes: c4c954547755 ("wifi: iwlwifi: implement WPFC ACPI table loading")
Reported-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Gregory Greenman Gregory <gregory.greenman@intel.com>
Link: https://msgid.link/20240128084842.2afeb476b62d.I200568dc42a277e21c12be99d5aaa39b009d45da@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index 359397a61715346926cb0e933a0d8e7354782f75..564eeb002e8edd94988ead93b7406280d3637166 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -1268,7 +1268,6 @@ void iwl_acpi_get_phy_filters(struct iwl_fw_runtime *fwrt,
        if (IS_ERR(data))
                return;
 
-       /* try to read wtas table revision 1 or revision 0*/
        wifi_pkg = iwl_acpi_get_wifi_pkg(fwrt->dev, data,
                                         ACPI_WPFC_WIFI_DATA_SIZE,
                                         &tbl_rev);
@@ -1278,13 +1277,14 @@ void iwl_acpi_get_phy_filters(struct iwl_fw_runtime *fwrt,
        if (tbl_rev != 0)
                goto out_free;
 
-       BUILD_BUG_ON(ARRAY_SIZE(filters->filter_cfg_chains) != ACPI_WPFC_WIFI_DATA_SIZE);
+       BUILD_BUG_ON(ARRAY_SIZE(filters->filter_cfg_chains) !=
+                    ACPI_WPFC_WIFI_DATA_SIZE - 1);
 
        for (i = 0; i < ARRAY_SIZE(filters->filter_cfg_chains); i++) {
-               if (wifi_pkg->package.elements[i].type != ACPI_TYPE_INTEGER)
-                       return;
+               if (wifi_pkg->package.elements[i + 1].type != ACPI_TYPE_INTEGER)
+                       goto out_free;
                tmp.filter_cfg_chains[i] =
-                       cpu_to_le32(wifi_pkg->package.elements[i].integer.value);
+                       cpu_to_le32(wifi_pkg->package.elements[i + 1].integer.value);
        }
 
        IWL_DEBUG_RADIO(fwrt, "Loaded WPFC filter config from ACPI\n");

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
index c36c62d6414de888d4e915a67185cdd2987ab722..8784e50407be8a75f8b32c9e2c3d76c2e74b29ef 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -56,7 +56,7 @@
 #define ACPI_EWRD_WIFI_DATA_SIZE_REV2  ((ACPI_SAR_PROFILE_NUM - 1) * \
                                         ACPI_SAR_NUM_CHAINS_REV2 * \
                                         ACPI_SAR_NUM_SUB_BANDS_REV2 + 3)
-#define ACPI_WPFC_WIFI_DATA_SIZE       4 /* 4 filter config words */
+#define ACPI_WPFC_WIFI_DATA_SIZE       5 /* domain and 4 filter config words */
 
 /* revision 0 and 1 are identical, except for the semantics in the FW */
 #define ACPI_GEO_NUM_BANDS_REV0                2