wifi: iwlwifi: fix a memory corruption
authorEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Thu, 11 Jan 2024 13:07:25 +0000 (15:07 +0200)
committerJohannes Berg <johannes.berg@intel.com>
Thu, 18 Jan 2024 13:50:39 +0000 (14:50 +0100)
commitcf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d
tree83af23eb1d03b64426e1e45257b199382bda1307
parentb01a74b3ca6fd51b62c67733ba7c3280fa6c5d26
wifi: iwlwifi: fix a memory corruption

iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that
if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in
bytes, we'll write past the buffer.

Cc: stable@vger.kernel.org
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218233
Fixes: cf29c5b66b9f ("iwlwifi: dbg_ini: implement time point handling")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20240111150610.2d2b8b870194.I14ed76505a5cf87304e0c9cc05cc0ae85ed3bf91@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c