From 8f55564c05123b790f25562fa02ca2e1dbf9c4f5 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 14 Mar 2023 19:49:34 +0200 Subject: [PATCH] wifi: iwlwifi: fw: pnvm: fix uefi reduced TX power loading There are a number of issues here: * if trans->reduce_power_loaded is already true, we call iwl_trans_set_reduce_power() with an uninitialized len value * in this case we also clobber a previous load/setting * if iwl_uefi_get_reduced_power() returns an ERR_PTR() we try to kfree() it Move the iwl_trans_set_reduce_power() call into the success case only to fix these issues. Signed-off-by: Johannes Berg Signed-off-by: Gregory Greenman Link: https://lore.kernel.org/r/20230314194113.aa2cf2281f5d.I33b4ab3427f1921c184c52fecd0f46781a89dc8a@changeid Signed-off-by: Johannes Berg --- drivers/net/wireless/intel/iwlwifi/fw/pnvm.c | 20 ++++++++------------ 1 file changed, 8 insertions(+), 12 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c index b6d3ac6ed440..c6f2672fdc73 100644 --- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c +++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause /* - * Copyright(c) 2020-2021 Intel Corporation + * Copyright(c) 2020-2022 Intel Corporation */ #include "iwl-drv.h" @@ -318,7 +318,6 @@ parse: kfree(data); skip_parse: - data = NULL; /* now try to get the reduce power table, if not loaded yet */ if (!trans->reduce_power_loaded) { data = iwl_uefi_get_reduced_power(trans, &len); @@ -329,19 +328,16 @@ skip_parse: * trying again over and over. */ trans->reduce_power_loaded = true; - - goto skip_reduce_power; + } else { + ret = iwl_trans_set_reduce_power(trans, data, len); + if (ret) + IWL_DEBUG_FW(trans, + "Failed to set reduce power table %d\n", + ret); + kfree(data); } } - ret = iwl_trans_set_reduce_power(trans, data, len); - if (ret) - IWL_DEBUG_FW(trans, - "Failed to set reduce power table %d\n", - ret); - kfree(data); - -skip_reduce_power: iwl_init_notification_wait(notif_wait, &pnvm_wait, ntf_cmds, ARRAY_SIZE(ntf_cmds), iwl_pnvm_complete_fn, trans);