From: Johannes Berg <johannes.berg@xxxxxxxxx>
There are a number of issues here:
* if trans->reduce_power_loaded is already true, we call
iwl_trans_set_reduce_power() with an uninitialized len
value
* in this case we also clobber a previous load/setting
* if iwl_uefi_get_reduced_power() returns an ERR_PTR() we
try to kfree() it
Move the iwl_trans_set_reduce_power() call into the success
case only to fix these issues.
Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
Signed-off-by: Gregory Greenman <gregory.greenman@xxxxxxxxx>
---
drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 20 ++++++++------------
1 file changed, 8 insertions(+), 12 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
index b6d3ac6ed440..c6f2672fdc73 100644
--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c
@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
- * Copyright(c) 2020-2021 Intel Corporation
+ * Copyright(c) 2020-2022 Intel Corporation
*/
#include "iwl-drv.h"
@@ -318,7 +318,6 @@ int iwl_pnvm_load(struct iwl_trans *trans,
kfree(data);
skip_parse:
- data = NULL;
/* now try to get the reduce power table, if not loaded yet */
if (!trans->reduce_power_loaded) {
data = iwl_uefi_get_reduced_power(trans, &len);
@@ -329,19 +328,16 @@ int iwl_pnvm_load(struct iwl_trans *trans,
* trying again over and over.
*/
trans->reduce_power_loaded = true;
-
- goto skip_reduce_power;
+ } else {
+ ret = iwl_trans_set_reduce_power(trans, data, len);
+ if (ret)
+ IWL_DEBUG_FW(trans,
+ "Failed to set reduce power table %d\n",
+ ret);
+ kfree(data);
}
}
- ret = iwl_trans_set_reduce_power(trans, data, len);
- if (ret)
- IWL_DEBUG_FW(trans,
- "Failed to set reduce power table %d\n",
- ret);
- kfree(data);
-
-skip_reduce_power:
iwl_init_notification_wait(notif_wait, &pnvm_wait,
ntf_cmds, ARRAY_SIZE(ntf_cmds),
iwl_pnvm_complete_fn, trans);
--
2.38.1
