00e8046b39
[ Upstream commit 07a6e3b78a65f4b2796a8d0d4adb1a15a81edead ]
1. The size of the response packet is not validated.
2. The response buffer is not freed.
Resolve these issues by switching to iwl_mvm_send_cmd_status(),
which handles both size validation and frees the buffer.
Fixes: f130bb75d881 ("iwlwifi: add FW recovery flow")
Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20241010140328.76c73185951e.Id3b6ca82ced2081f5ee4f33c997491d0ebda83f7@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
|---|---|---|
| .. | ||
| cfg | ||
| dvm | ||
| fw | ||
| mvm | ||
| pcie | ||
| queue | ||
| iwl-agn-hw.h | ||
| iwl-config.h | ||
| iwl-context-info-gen3.h | ||
| iwl-context-info.h | ||
| iwl-csr.h | ||
| iwl-dbg-tlv.c | ||
| iwl-dbg-tlv.h | ||
| iwl-debug.c | ||
| iwl-debug.h | ||
| iwl-devtrace-data.h | ||
| iwl-devtrace-io.h | ||
| iwl-devtrace-iwlwifi.h | ||
| iwl-devtrace-msg.h | ||
| iwl-devtrace-ucode.h | ||
| iwl-devtrace.c | ||
| iwl-devtrace.h | ||
| iwl-drv.c | ||
| iwl-drv.h | ||
| iwl-eeprom-parse.c | ||
| iwl-eeprom-parse.h | ||
| iwl-eeprom-read.c | ||
| iwl-eeprom-read.h | ||
| iwl-fh.h | ||
| iwl-io.c | ||
| iwl-io.h | ||
| iwl-modparams.h | ||
| iwl-nvm-parse.c | ||
| iwl-nvm-parse.h | ||
| iwl-op-mode.h | ||
| iwl-phy-db.c | ||
| iwl-phy-db.h | ||
| iwl-prph.h | ||
| iwl-scd.h | ||
| iwl-trans.c | ||
| iwl-trans.h | ||
| Kconfig | ||
| Makefile | ||