From: Dmitry Antipov Date: Mon, 9 Oct 2023 17:04:49 +0000 (+0300) Subject: wifi: iwlwifi: check for kmemdup() return value in iwl_parse_tlv_firmware() X-Git-Tag: io_uring-6.7-2023-11-10~40^2~27^2~65 X-Git-Url: https://git.kernel.dk/?a=commitdiff_plain;h=3c8aaaa7557b1e33e6ef95a27a5d8a139dcd0874;p=linux-2.6-block.git wifi: iwlwifi: check for kmemdup() return value in iwl_parse_tlv_firmware() In 'iwl_parse_tlv_firmware()', check for 'kmemdup()' return value when handling IWL_UCODE_TLV_CURRENT_PC and set the number of parsed entries only if an allocation was successful (just like it does with handling IWL_UCODE_TLV_CMD_VERSIONS above). Compile tested only. Signed-off-by: Dmitry Antipov Acked-by: Gregory Greenman Link: https://lore.kernel.org/r/20231009170453.149905-1-dmantipov@yandex.ru Signed-off-by: Johannes Berg --- diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c index c4e50f204630..b26e9c3c37b7 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c @@ -1303,10 +1303,12 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv, case IWL_UCODE_TLV_CURRENT_PC: if (tlv_len < sizeof(struct iwl_pc_data)) goto invalid_tlv_len; - drv->trans->dbg.num_pc = - tlv_len / sizeof(struct iwl_pc_data); drv->trans->dbg.pc_data = kmemdup(tlv_data, tlv_len, GFP_KERNEL); + if (!drv->trans->dbg.pc_data) + return -ENOMEM; + drv->trans->dbg.num_pc = + tlv_len / sizeof(struct iwl_pc_data); break; default: IWL_DEBUG_INFO(drv, "unknown TLV: %d\n", tlv_type);