Index | Thread | Search

From:
Denis Fondras <denis@openbsd.org>
Subject:
iwx(4): don't bail if capability index is too large
To:
Stefan Sperling <stsp@stsp.name>, tech@openbsd.org
Date:
Sat, 3 Jan 2026 18:44:35 +0100

Download raw body.

Thread
  • Denis Fondras:

    iwx(4): don't bail if capability index is too large

When loading firmware "bz-b0-fm-c0-100" (for the Intel WiFi 6e AX211 160MHz),
the capability index is too large. iwx(4) will then stop processing and not load
the firmware further.
The Linux driver will just print a message and go on loading more sections form
the firmware file.

Perhaps we could do the same ?

Denis

Index: if_iwx.c
===================================================================
RCS file: /cvs/src/sys/dev/pci/if_iwx.c,v
diff -u -p -r1.194 if_iwx.c
--- if_iwx.c	1 Dec 2025 16:44:13 -0000	1.194
+++ if_iwx.c	3 Jan 2026 15:07:48 -0000
@@ -1378,7 +1378,12 @@ iwx_read_firmware(struct iwx_softc *sc)
 			capa = (struct iwx_ucode_capa *)tlv_data;
 			idx = le32toh(capa->api_index);
 			if (idx >= howmany(IWX_NUM_UCODE_TLV_CAPA, 32)) {
-				goto parse_out;
+				struct ifnet *ifp = &ic->ic_if;
+				if (ifp->if_flags & IFF_DEBUG)
+					printf("%s: capability index %d "
+					    "larger than supported\n",
+					    DEVNAME(sc), capa->api_index);
+				break;
 			}
 			for (i = 0; i < 32; i++) {
 				if ((le32toh(capa->api_capa) & (1 << i)) == 0)