iwlwifi: yoyo: don't access TLV before verifying len
authorMordechay Goodstein <mordechay.goodstein@intel.com>
Fri, 24 Apr 2020 15:48:11 +0000 (18:48 +0300)
committerLuca Coelho <luciano.coelho@intel.com>
Fri, 8 May 2020 06:50:46 +0000 (09:50 +0300)
commit0c9e025e797e02c35449b3ad08d3317e5fc7d7b8
treea24cdde6216735d40ad0409d731853be9112aea9
parentf25c418dcad93755cf48537d60a46070112be72c
iwlwifi: yoyo: don't access TLV before verifying len

If we access the TLV memory with shorter len than the struct
we access garbage data that was not given by the user.

On the way rewrite the checker in a cleaner way.

Signed-off-by: Mordechay Goodstein <mordechay.goodstein@intel.com>
Fixes: a9248de42464 ("iwlwifi: dbg_ini: add TLV allocation new API support")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Link: https://lore.kernel.org/r/iwlwifi.20200424182644.54418c829390.I15d6b462a0e69a280b6c6cfbcb6bcb05bb5f79ee@changeid
drivers/net/wireless/intel/iwlwifi/fw/api/dbg-tlv.h
drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c