Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ed83da3 authored by Luca Coelho's avatar Luca Coelho
Browse files

iwlwifi: fix ACPI table revision checks 



We can't check for the ACPI table revision validity in the same if
where we check if the package was read correctly, because we return
PTR_ERR(pkg) and if the table is not valid but the pointer is, we
would return a valid pointer as an error.  Fix that by moving the
table checks to a separate if and return -EINVAL if it's not valid.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
parent 1fee35d0

drivers/net/wireless/intel/iwlwifi/fw/acpi.c

+6 −4
Original line number Diff line number Diff line
@@ -162,12 +162,13 @@ int iwl_acpi_get_mcc(struct device *dev, char *mcc) 


	wifi_pkg = iwl_acpi_get_wifi_pkg(dev, data, ACPI_WRDD_WIFI_DATA_SIZE,

					 &tbl_rev);

	if (IS_ERR(wifi_pkg) || tbl_rev != 0) {

	if (IS_ERR(wifi_pkg)) {

		ret = PTR_ERR(wifi_pkg);

		goto out_free;

	}



	if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) {

	if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER ||

	    tbl_rev != 0) {

		ret = -EINVAL;

		goto out_free;

	}
@@ -224,12 +225,13 @@ int iwl_acpi_get_eckv(struct device *dev, u32 *extl_clk) 


	wifi_pkg = iwl_acpi_get_wifi_pkg(dev, data, ACPI_ECKV_WIFI_DATA_SIZE,

					 &tbl_rev);

	if (IS_ERR(wifi_pkg) || tbl_rev != 0) {

	if (IS_ERR(wifi_pkg)) {

		ret = PTR_ERR(wifi_pkg);

		goto out_free;

	}



	if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) {

	if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER ||

	    tbl_rev != 0) {

		ret = -EINVAL;

		goto out_free;

	}

drivers/net/wireless/intel/iwlwifi/mvm/fw.c

+18 −6
Original line number Diff line number Diff line
@@ -694,12 +694,13 @@ static int iwl_mvm_sar_get_wrds_table(struct iwl_mvm *mvm) 


	wifi_pkg = iwl_acpi_get_wifi_pkg(mvm->dev, data,

					 ACPI_WRDS_WIFI_DATA_SIZE, &tbl_rev);

	if (IS_ERR(wifi_pkg) || tbl_rev != 0) {

	if (IS_ERR(wifi_pkg)) {

		ret = PTR_ERR(wifi_pkg);

		goto out_free;

	}



	if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) {

	if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER ||

	    tbl_rev != 0) {

		ret = -EINVAL;

		goto out_free;

	}
@@ -731,13 +732,14 @@ static int iwl_mvm_sar_get_ewrd_table(struct iwl_mvm *mvm) 


	wifi_pkg = iwl_acpi_get_wifi_pkg(mvm->dev, data,

					 ACPI_EWRD_WIFI_DATA_SIZE, &tbl_rev);

	if (IS_ERR(wifi_pkg) || tbl_rev != 0) {

	if (IS_ERR(wifi_pkg)) {

		ret = PTR_ERR(wifi_pkg);

		goto out_free;

	}



	if ((wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) ||

	    (wifi_pkg->package.elements[2].type != ACPI_TYPE_INTEGER)) {

	    (wifi_pkg->package.elements[2].type != ACPI_TYPE_INTEGER) ||

	    tbl_rev != 0) {

		ret = -EINVAL;

		goto out_free;

	}
@@ -791,11 +793,16 @@ static int iwl_mvm_sar_get_wgds_table(struct iwl_mvm *mvm) 


	wifi_pkg = iwl_acpi_get_wifi_pkg(mvm->dev, data,

					 ACPI_WGDS_WIFI_DATA_SIZE, &tbl_rev);

	if (IS_ERR(wifi_pkg) || tbl_rev > 1) {

	if (IS_ERR(wifi_pkg)) {

		ret = PTR_ERR(wifi_pkg);

		goto out_free;

	}



	if (tbl_rev != 0) {

		ret = -EINVAL;

		goto out_free;

	}



	mvm->geo_rev = tbl_rev;

	for (i = 0; i < ACPI_NUM_GEO_PROFILES; i++) {

		for (j = 0; j < ACPI_GEO_TABLE_SIZE; j++) {
@@ -1020,11 +1027,16 @@ static int iwl_mvm_get_ppag_table(struct iwl_mvm *mvm) 
	wifi_pkg = iwl_acpi_get_wifi_pkg(mvm->dev, data,

					 ACPI_PPAG_WIFI_DATA_SIZE, &tbl_rev);



	if (IS_ERR(wifi_pkg) || tbl_rev != 0) {

	if (IS_ERR(wifi_pkg)) {

		ret = PTR_ERR(wifi_pkg);

		goto out_free;

	}



	if (tbl_rev != 0) {

		ret = -EINVAL;

		goto out_free;

	}



	enabled = &wifi_pkg->package.elements[1];

	if (enabled->type != ACPI_TYPE_INTEGER ||

	    (enabled->integer.value != 0 && enabled->integer.value != 1)) {