wifi: iwlwifi: fw: fix wgds rev 3 exact size

Check size of WGDS revision 3 is equal to 8 entries size with some header,
but doesn't depend on the number of used entries. Check that used entries
are between min and max but allow more to be present than are used to fix
operation with some BIOSes that have such data.

Fixes: 97f8a3d1610b ("iwlwifi: ACPI: support revision 3 WGDS tables")
Signed-off-by: Anjaneyulu <pagadala.yesu.anjaneyulu@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20240825191257.cc71dfc67ec3.Ic27ee15ac6128b275c210b6de88f2145bd83ca7b@changeid
[edit commit message]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index 79774c8c7ff4526b9ca1e6bf215df9931d1ba071..8c8880b4482701f27c784093da57d1acf480389d 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -725,22 +725,25 @@ int iwl_acpi_get_wgds_table(struct iwl_fw_runtime *fwrt)
                                entry = &wifi_pkg->package.elements[entry_idx];
                                entry_idx++;
                                if (entry->type != ACPI_TYPE_INTEGER ||
-                                   entry->integer.value > num_profiles) {
+                                   entry->integer.value > num_profiles ||
+                                   entry->integer.value <
+                                       rev_data[idx].min_profiles) {
                                        ret = -EINVAL;
                                        goto out_free;
                                }
-                               num_profiles = entry->integer.value;
 
                                /*
-                                * this also validates >= min_profiles since we
-                                * otherwise wouldn't have gotten the data when
-                                * looking up in ACPI
+                                * Check to see if we received package count
+                                * same as max # of profiles
                                 */
                                if (wifi_pkg->package.count !=
                                    hdr_size + profile_size * num_profiles) {
                                        ret = -EINVAL;
                                        goto out_free;
                                }
+
+                               /* Number of valid profiles */
+                               num_profiles = entry->integer.value;
                        }
                        goto read_table;
                }