wifi: iwlwifi: mvm: validate SAR GEO response payload size

The SAR GEO command response is cast to
iwl_geo_tx_power_profiles_resp without verifying the payload length.
A malformed or unexpected firmware response can lead to reading an
invalid structure layout.

Add an explicit size check before accessing the response data and
return -EIO when the payload size is wrong.

Fixes: f604324eefec ("iwlwifi: remove iwl_validate_sar_geo_profile() export")
Signed-off-by: Pagadala Yesu Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.7e749b7d374a.I4ef54548bff6c6e7c7a57bee771ac12508aad677@changeid

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 6e507d6dcdd2a1557261409beba0aec2715c016a..fa523be91d8ad334f63c68b8a7eed5376e028503 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -964,12 +964,22 @@ int iwl_mvm_get_sar_geo_profile(struct iwl_mvm *mvm)
                return ret;
        }
 
+       if (IWL_FW_CHECK(mvm,
+                        iwl_rx_packet_payload_len(cmd.resp_pkt) !=
+                        sizeof(*resp),
+                        "Wrong size for iwl_geo_tx_power_profiles_resp: %d\n",
+                        iwl_rx_packet_payload_len(cmd.resp_pkt))) {
+               ret = -EIO;
+               goto out;
+       }
+
        resp = (void *)cmd.resp_pkt->data;
        ret = le32_to_cpu(resp->profile_idx);
 
        if (WARN_ON(ret > BIOS_GEO_MAX_PROFILE_NUM))
                ret = -EIO;
 
+out:
        iwl_free_resp(&cmd);
        return ret;
 }