[PATCH] wifi: iwlwifi: validate PNVM SKU TLV length
From: Pengpeng Hou
Date: Tue Jun 30 2026 - 03:27:50 EST
iwl_pnvm_parse() reads three SKU words from IWL_UCODE_TLV_PNVM_SKU TLVs
after only checking the generic TLV length.
Add a type-specific minimum payload length check before reading the SKU
words.
Signed-off-by: Pengpeng Hou <pengpeng@xxxxxxxxxxx>
---
drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
index afff8d5..f61e69b 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
@@ -198,6 +198,12 @@ static int iwl_pnvm_parse(struct iwl_trans *trans, const u8 *data,
IWL_DEBUG_FW(trans,
"Got IWL_UCODE_TLV_PNVM_SKU len %d\n",
tlv_len);
+ if (tlv_len < 3 * sizeof(__le32)) {
+ IWL_ERR(trans, "invalid PNVM SKU TLV len: %u\n",
+ tlv_len);
+ return -EINVAL;
+ }
+
IWL_DEBUG_FW(trans, "sku_id 0x%0x 0x%0x 0x%0x\n",
le32_to_cpu(tlv_sku_id->data[0]),
le32_to_cpu(tlv_sku_id->data[1]),