[Intel-wired-lan] [PATCH iwl-net v2] ice: avoid infinite loop if NVM has invalid TLV length

Jacob Keller jacob.e.keller at intel.com
Fri May 17 23:18:00 UTC 2024



On 5/17/2024 4:08 PM, Jacob Keller wrote:

> -		next_tlv = next_tlv + tlv_len + 2;
> +		if (check_add_overflow(next_tlv, 2, &next_tlv) ||
> +		    check_add_overflow(next_tlv, tlv_len, &next_tlv))
> +			dev_warn(ice_hw_to_dev(hw), "Failed to locate PFA TLV module of type %u due to arithmetic overflow. The PFA length is %u. The last TLV has length of %u\n",
> +				 module_type, pfa_len, tlv_len);
> +			return -EINVAL;
> +		}

This hunk is missing a { which I had fixed locally but forgot to ammend.
I'll have it fixed in a v3 later.. :(

Thanks,
Jake


More information about the Intel-wired-lan mailing list