]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
wifi: iwlwifi: pcie: validate FW section counts in iwl_pcie_init_fw_sec
authorEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Wed, 15 Jul 2026 18:57:10 +0000 (21:57 +0300)
committerMiri Korenblit <miriam.rachel.korenblit@intel.com>
Thu, 16 Jul 2026 18:12:19 +0000 (21:12 +0300)
commit7b271df210848e8d0dd9c0d7b032050b3f3affbf
treeb6769696d1e24d6e280d7dac774d403ac54379ba
parent7455ba7b4d6d869e337db063c466033cf9392fb5
wifi: iwlwifi: pcie: validate FW section counts in iwl_pcie_init_fw_sec

iwl_pcie_init_fw_sec() iterates over LMAC, UMAC, and paging
firmware sections and writes to ctxt_dram->lmac_img[i],
ctxt_dram->umac_img[i], and ctxt_dram->virtual_img[i] without
first verifying that the counts derived from the firmware image
do not exceed the array size. An oversized firmware image could
cause out-of-bounds writes into the fixed-size context-info DRAM
arrays.

Add explicit WARN_ON checks for all three section counts and
return -EINVAL if any is exceeded.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.34db46ca12f3.I1aa225492a62f25293c147aa7293afa80a5d4215@changeid
drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c