wifi: iwlwifi: dbg-tlv: bound aligned TLV walk length

Validate ALIGN(tlv_len, 4) before advancing through external debug
TLVs to prevent parser length underflow.

Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717173215.e08d6550c6ec.Iad64190a7d5cded553aff41973120396aef1b557@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
index d021b24d04d6b9b6c8ae9461f0b975026642347d..b1a55909f0d4bc3e562b0ee38359a95150f4a5d8 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c
@@ -475,6 +475,7 @@ static int iwl_dbg_tlv_parse_bin(struct iwl_trans *trans, const u8 *data,
 {
        const struct iwl_ucode_tlv *tlv;
        u32 tlv_len;
+       size_t aligned_tlv_len;
 
        while (len >= sizeof(*tlv)) {
                len -= sizeof(*tlv);
@@ -487,8 +488,16 @@ static int iwl_dbg_tlv_parse_bin(struct iwl_trans *trans, const u8 *data,
                                len, tlv_len);
                        return -EINVAL;
                }
-               len -= ALIGN(tlv_len, 4);
-               data += sizeof(*tlv) + ALIGN(tlv_len, 4);
+
+               aligned_tlv_len = ALIGN(tlv_len, 4);
+               if (len < aligned_tlv_len) {
+                       IWL_ERR(trans, "invalid aligned TLV len: %zd/%zu\n",
+                               len, aligned_tlv_len);
+                       return -EINVAL;
+               }
+
+               len -= aligned_tlv_len;
+               data += sizeof(*tlv) + aligned_tlv_len;
 
                iwl_dbg_tlv_alloc(trans, tlv, true);
        }