]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: iwlwifi: mvm: validate SAR GEO response payload size
authorPagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Wed, 15 Jul 2026 18:57:04 +0000 (21:57 +0300)
committerMiri Korenblit <miriam.rachel.korenblit@intel.com>
Thu, 16 Jul 2026 18:12:17 +0000 (21:12 +0300)
commit408d7da38272ce48e2db79b8a9895999f94d7655
tree3d03097342046ff8f00c0896b6d183272e9a8d8c
parent8d70881707b47353359df57df12f6de67fdacdd2
wifi: iwlwifi: mvm: validate SAR GEO response payload size

The SAR GEO command response is cast to
iwl_geo_tx_power_profiles_resp without verifying the payload length.
A malformed or unexpected firmware response can lead to reading an
invalid structure layout.

Add an explicit size check before accessing the response data and
return -EIO when the payload size is wrong.

Fixes: f604324eefec ("iwlwifi: remove iwl_validate_sar_geo_profile() export")
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.7e749b7d374a.I4ef54548bff6c6e7c7a57bee771ac12508aad677@changeid
drivers/net/wireless/intel/iwlwifi/mvm/fw.c