00e8046b39
[ Upstream commit 07a6e3b78a65f4b2796a8d0d4adb1a15a81edead ]
1. The size of the response packet is not validated.
2. The response buffer is not freed.
Resolve these issues by switching to iwl_mvm_send_cmd_status(),
which handles both size validation and frees the buffer.
Fixes: f130bb75d881 ("iwlwifi: add FW recovery flow")
Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241010140328.76c73185951e.Id3b6ca82ced2081f5ee4f33c997491d0ebda83f7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|---|---|---|
| .. | ||
| binding.c | ||
| coex.c | ||
| constants.h | ||
| d3.c | ||
| debugfs-vif.c | ||
| debugfs.c | ||
| debugfs.h | ||
| ftm-initiator.c | ||
| ftm-responder.c | ||
| fw-api.h | ||
| fw.c | ||
| led.c | ||
| mac-ctxt.c | ||
| mac80211.c | ||
| Makefile | ||
| mvm.h | ||
| nvm.c | ||
| offloading.c | ||
| ops.c | ||
| phy-ctxt.c | ||
| power.c | ||
| quota.c | ||
| rs-fw.c | ||
| rs.c | ||
| rs.h | ||
| rx.c | ||
| rxmq.c | ||
| scan.c | ||
| sf.c | ||
| sta.c | ||
| sta.h | ||
| tdls.c | ||
| testmode.h | ||
| time-event.c | ||
| time-event.h | ||
| tt.c | ||
| tx.c | ||
| utils.c | ||