nxpwifi_parse_cal_cfg() passes a pointer into the raw firmware buffer to kstrtou8(). Because kstrtou8() requires a NUL- or newline-terminated string, it fails with -EINVAL as soon as it encounters a space after the first byte, causing nxpwifi_parse_cal_cfg() to return 0 bytes. Use hex2bin() instead to parse each two-character hex byte, bound the output buffer to the command buffer capacity, and return -EINVAL when no calibration data is parsed. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Assisted-by: GitHub-Copilot:Gemini-4-Argon Signed-off-by: Viktor Korsnes --- drivers/net/wireless/nxp/nxpwifi/sta_cmd.c | 23 +++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/drivers/net/wireless/nxp/nxpwifi/sta_cmd.c b/drivers/net/wireless/nxp/nxpwifi/sta_cmd.c index 5e8ffd306b31..f3cd5a51c438 100644 --- a/drivers/net/wireless/nxp/nxpwifi/sta_cmd.c +++ b/drivers/net/wireless/nxp/nxpwifi/sta_cmd.c @@ -1391,7 +1391,7 @@ nxpwifi_ret_sta_mem_access(struct nxpwifi_private *priv, return 0; } -static u32 nxpwifi_parse_cal_cfg(u8 *src, size_t len, u8 *dst) +static u32 nxpwifi_parse_cal_cfg(u8 *src, size_t len, u8 *dst, size_t dst_size) { u8 *s = src, *d = dst; @@ -1401,7 +1401,8 @@ static u32 nxpwifi_parse_cal_cfg(u8 *src, size_t len, u8 *dst) continue; } if (isxdigit(*s)) { - if (kstrtou8(s, 16, d)) + if (d - dst >= dst_size || src + len - s < 2 || + hex2bin(d, s, 1)) return 0; d++; s += 2; @@ -1423,14 +1424,18 @@ nxpwifi_cmd_sta_cfg_data(struct nxpwifi_private *priv, u32 len; u8 *data = (u8 *)cmd + S_DS_GEN; - if (adapter->cal_data->data && adapter->cal_data->size > 0) { - len = nxpwifi_parse_cal_cfg((u8 *)adapter->cal_data->data, - adapter->cal_data->size, data); - nxpwifi_dbg(adapter, INFO, - "download cfg_data from config file\n"); - } else { + if (!adapter->cal_data || !adapter->cal_data->data || + !adapter->cal_data->size) return -EINVAL; - } + + len = nxpwifi_parse_cal_cfg((u8 *)adapter->cal_data->data, + adapter->cal_data->size, data, + NXPWIFI_SIZE_OF_CMD_BUFFER - S_DS_GEN); + if (!len) + return -EINVAL; + + nxpwifi_dbg(adapter, INFO, + "download cfg_data from config file\n"); cmd->command = cpu_to_le16(HOST_CMD_CFG_DATA); cmd->size = cpu_to_le16(S_DS_GEN + len); -- 2.53.0