From: Haim Dreyfuss <haim.dreyfuss@xxxxxxxxx> iwl_acpi_get_wifi_pkg() may return a valid pointer (meaning success), while `tbl_rev` is invalid (equel to 1). In this case, we will treat that as an error. Subsequent "users" of this "error code" may either check for nonzero (good; pointers are never zero) or negative (bad; pointers may be "positive") fix that by splitting the if statement. First check if IS_ERR(wifi_pkg) and then if tbl_rev != 0. Signed-off-by: Haim Dreyfuss <haim.dreyfuss@xxxxxxxxx> Signed-off-by: Luca Coelho <luciano.coelho@xxxxxxxxx> --- drivers/net/wireless/intel/iwlwifi/fw/acpi.c | 22 +++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c index d8b7776a8dde..6aa0dbfa3b6c 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c +++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c @@ -478,11 +478,16 @@ int iwl_sar_get_wrds_table(struct iwl_fw_runtime *fwrt) wifi_pkg = iwl_acpi_get_wifi_pkg(fwrt->dev, data, ACPI_WRDS_WIFI_DATA_SIZE, &tbl_rev); - if (IS_ERR(wifi_pkg) || tbl_rev != 0) { + if (IS_ERR(wifi_pkg)) { ret = PTR_ERR(wifi_pkg); goto out_free; } + if (tbl_rev != 0) { + ret = -EINVAL; + goto out_free; + } + if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) { ret = -EINVAL; goto out_free; @@ -516,11 +521,16 @@ int iwl_sar_get_ewrd_table(struct iwl_fw_runtime *fwrt) wifi_pkg = iwl_acpi_get_wifi_pkg(fwrt->dev, data, ACPI_EWRD_WIFI_DATA_SIZE, &tbl_rev); - if (IS_ERR(wifi_pkg) || tbl_rev != 0) { + if (IS_ERR(wifi_pkg)) { ret = PTR_ERR(wifi_pkg); goto out_free; } + if (tbl_rev != 0) { + ret = -EINVAL; + goto out_free; + } + if (wifi_pkg->package.elements[1].type != ACPI_TYPE_INTEGER || wifi_pkg->package.elements[2].type != ACPI_TYPE_INTEGER) { ret = -EINVAL; @@ -576,11 +586,17 @@ int iwl_sar_get_wgds_table(struct iwl_fw_runtime *fwrt) wifi_pkg = iwl_acpi_get_wifi_pkg(fwrt->dev, data, ACPI_WGDS_WIFI_DATA_SIZE, &tbl_rev); - if (IS_ERR(wifi_pkg) || tbl_rev > 1) { + + if (IS_ERR(wifi_pkg)) { ret = PTR_ERR(wifi_pkg); goto out_free; } + if (tbl_rev > 1) { + ret = -EINVAL; + goto out_free; + } + fwrt->geo_rev = tbl_rev; for (i = 0; i < ACPI_NUM_GEO_PROFILES; i++) { for (j = 0; j < ACPI_GEO_TABLE_SIZE; j++) { -- 2.30.0