wifi: iwlwifi: acpi: fix WPFC reading

The code reading the WPFC table needs to take into account
the domain type (first element in the package), shouldn't
leak the memory if it fails, and has a bad comment. Fix all
these issues.

Fixes: c4c954547755 ("wifi: iwlwifi: implement WPFC ACPI table loading")
Reported-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Gregory Greenman Gregory <gregory.greenman@intel.com>
Link: https://msgid.link/20240128084842.2afeb476b62d.I200568dc42a277e21c12be99d5aaa39b009d45da@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
index b96f30d..72a0a95 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.c
@@ -1293,7 +1293,6 @@ void iwl_acpi_get_phy_filters(struct iwl_fw_runtime *fwrt,
        if (IS_ERR(data))
                return;
 
-       /* try to read wtas table revision 1 or revision 0*/
        wifi_pkg = iwl_acpi_get_wifi_pkg(fwrt->dev, data,
                                         ACPI_WPFC_WIFI_DATA_SIZE,
                                         &tbl_rev);
@@ -1303,13 +1302,14 @@ void iwl_acpi_get_phy_filters(struct iwl_fw_runtime *fwrt,
        if (tbl_rev != 0)
                goto out_free;
 
-       BUILD_BUG_ON(ARRAY_SIZE(filters->filter_cfg_chains) != ACPI_WPFC_WIFI_DATA_SIZE);
+       BUILD_BUG_ON(ARRAY_SIZE(filters->filter_cfg_chains) !=
+                    ACPI_WPFC_WIFI_DATA_SIZE - 1);
 
        for (i = 0; i < ARRAY_SIZE(filters->filter_cfg_chains); i++) {
-               if (wifi_pkg->package.elements[i].type != ACPI_TYPE_INTEGER)
-                       return;
+               if (wifi_pkg->package.elements[i + 1].type != ACPI_TYPE_INTEGER)
+                       goto out_free;
                tmp.filter_cfg_chains[i] =
-                       cpu_to_le32(wifi_pkg->package.elements[i].integer.value);
+                       cpu_to_le32(wifi_pkg->package.elements[i + 1].integer.value);
        }
 
        IWL_DEBUG_RADIO(fwrt, "Loaded WPFC filter config from ACPI\n");

diff --git a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
index e9277f6..39106cc 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
+++ b/drivers/net/wireless/intel/iwlwifi/fw/acpi.h
@@ -56,7 +56,7 @@
 #define ACPI_EWRD_WIFI_DATA_SIZE_REV2  ((ACPI_SAR_PROFILE_NUM - 1) * \
                                         ACPI_SAR_NUM_CHAINS_REV2 * \
                                         ACPI_SAR_NUM_SUB_BANDS_REV2 + 3)
-#define ACPI_WPFC_WIFI_DATA_SIZE       4 /* 4 filter config words */
+#define ACPI_WPFC_WIFI_DATA_SIZE       5 /* domain and 4 filter config words */
 
 /* revision 0 and 1 are identical, except for the semantics in the FW */
 #define ACPI_GEO_NUM_BANDS_REV0                2