RE: [PATCH] wifi: iwlwifi: validate UEFI reduced-power SKU TLV length

[Korenblit, Miriam Rachel]

> -----Original Message-----
> From: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> Sent: Tuesday, June 30, 2026 10:23 AM
> To: Korenblit, Miriam Rachel <miriam.rachel.korenblit@xxxxxxxxx>
> Cc: open list:INTEL WIRELESS WIFI LINK iwlwifi <linux-
> wireless@xxxxxxxxxxxxxxx>; open list <linux-kernel@xxxxxxxxxxxxxxx>; Pengpeng
> Hou <pengpeng@xxxxxxxxxxx>
> Subject: [PATCH] wifi: iwlwifi: validate UEFI reduced-power SKU TLV length
> 
> iwl_uefi_reduce_power_parse() reads three SKU words from
> IWL_UCODE_TLV_PNVM_SKU TLVs after only checking the generic TLV length.
> 
> Add the same type-specific minimum payload length check before reading the
> SKU words.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
> ---
>  drivers/net/wireless/intel/iwlwifi/fw/uefi.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
> b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
> index 2ef0a7a..747df65 100644
> --- a/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
> +++ b/drivers/net/wireless/intel/iwlwifi/fw/uefi.c
> @@ -248,6 +248,12 @@ int iwl_uefi_reduce_power_parse(struct iwl_trans
> *trans,
>  			IWL_DEBUG_FW(trans,
>  				     "Got IWL_UCODE_TLV_PNVM_SKU len
> %d\n",
>  				     tlv_len);
> +			if (tlv_len < 3 * sizeof(__le32)) {

Please use sizeof(*tlv_sku_id)

> +				IWL_ERR(trans, "invalid PNVM SKU TLV len:
> %u\n",
> +					tlv_len);
> +				return -EINVAL;
> +			}
> +
>  			IWL_DEBUG_FW(trans, "sku_id 0x%0x 0x%0x 0x%0x\n",
>  				     le32_to_cpu(tlv_sku_id->data[0]),
>  				     le32_to_cpu(tlv_sku_id->data[1]),