wifi: iwlwifi: bound aligned TLV advance in FW parser

Validate ALIGN(tlv_len, 4) against remaining parser length before
consuming bytes from the firmware image.

This avoids length underflow on malformed TLVs.

Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717173215.393c286488f9.Ia39144dc3ca334325ee4eacb7420901e2446fc23@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 842586d4fc5ce4a2f1f12a524a9e518a27d2d5c4..001895f4f4bd8af41da0b35ef160c6ee86ed450d 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -804,6 +804,7 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
        u32 build, paging_mem_size;
        int num_of_cpus;
        bool usniffer_req = false;
+       size_t aligned_tlv_len;
 
        if (len < sizeof(*ucode)) {
                IWL_ERR(drv, "uCode has invalid length: %zd\n", len);
@@ -852,8 +853,16 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                                len, tlv_len);
                        return -EINVAL;
                }
-               len -= ALIGN(tlv_len, 4);
-               data += sizeof(*tlv) + ALIGN(tlv_len, 4);
+
+               aligned_tlv_len = ALIGN(tlv_len, 4);
+               if (len < aligned_tlv_len) {
+                       IWL_ERR(drv, "invalid aligned TLV len: %zd/%zu\n",
+                               len, aligned_tlv_len);
+                       return -EINVAL;
+               }
+
+               len -= aligned_tlv_len;
+               data += sizeof(*tlv) + aligned_tlv_len;
 
                switch (tlv_type) {
                case IWL_UCODE_TLV_INST: