wifi: iwlwifi: validate SEC_RT TLV minimum size

Reject firmware section TLVs that are shorter than the offset field
before subtracting sizeof(offset) from the section size.

This prevents size underflow for malformed TLVs.

Assisted-by: GitHubCopilot:GPT-5.3-Codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Link: https://patch.msgid.link/20260717173215.17b040b27edc.I6b32d1e9ad707417e2e604f08a63582456209372@changeid
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 001895f4f4bd8af41da0b35ef160c6ee86ed450d..7f1515dfc5bf9d8db1eb2f54bfb4ef8ebaac624f 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -492,7 +492,7 @@ static void set_sec_offset(struct iwl_firmware_pieces *pieces,
  * Gets uCode section from tlv.
  */
 static int iwl_store_ucode_sec(struct fw_img_parsing *img,
-                              const void *data, int size)
+                              const void *data, size_t size)
 {
        struct fw_sec *sec;
        const struct fw_sec_parsing *sec_parse;
@@ -501,6 +501,9 @@ static int iwl_store_ucode_sec(struct fw_img_parsing *img,
        if (WARN_ON(!img || !data))
                return -EINVAL;
 
+       if (size < sizeof(sec_parse->offset))
+               return -EINVAL;
+
        sec_parse = (const struct fw_sec_parsing *)data;
 
        alloc_size = sizeof(*img->sec) * (img->sec_counter + 1);