wifi: iwlwifi: pcie: validate FW section counts in iwl_pcie_init_fw_sec

Browse source

iwl_pcie_init_fw_sec() iterates over LMAC, UMAC, and paging
firmware sections and writes to ctxt_dram->lmac_img[i],
ctxt_dram->umac_img[i], and ctxt_dram->virtual_img[i] without
first verifying that the counts derived from the firmware image
do not exceed the array size. An oversized firmware image could
cause out-of-bounds writes into the fixed-size context-info DRAM
arrays.

Add explicit WARN_ON checks for all three section counts and
return -EINVAL if any is exceeded.

Assisted-by: GitHubCopilot:gpt-5.3-codex
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20260715215523.34db46ca12f3.I1aa225492a62f25293c147aa7293afa80a5d4215@changeid

...

This commit is contained in:

Emmanuel Grumbach 2026-07-15 21:57:10 +03:00 • committed by Miri Korenblit

parent 7455ba7b4d

commit 7b271df210

1 changed files with 6 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

7

drivers/net/wireless/intel/iwlwifi/pcie/ctxt-info.c

View file