瀏覽代碼

wlcore: check minimum buffer size in some cmd_send functions

Check for the minimum required buffer length in wlcore_cmd_send() and
wlcore_cmd_configure_failsafe.  This ensures that we will never try to
use a buffer that is smaller than the required header.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Luciano Coelho 10 年之前
父節點
當前提交
f5b8f4790b
共有 1 個文件被更改,包括 6 次插入0 次删除
  1. 6 0
      drivers/net/wireless/ti/wlcore/cmd.c

+ 6 - 0
drivers/net/wireless/ti/wlcore/cmd.c

@@ -64,6 +64,9 @@ static int __wlcore_cmd_send(struct wl1271 *wl, u16 id, void *buf,
 		     id != CMD_STOP_FWLOGGER))
 		return -EIO;
 
+	if (WARN_ON_ONCE(len < sizeof(*cmd)))
+		return -EIO;
+
 	cmd = buf;
 	cmd->id = cpu_to_le16(id);
 	cmd->status = 0;
@@ -891,6 +894,9 @@ int wlcore_cmd_configure_failsafe(struct wl1271 *wl, u16 id, void *buf,
 
 	wl1271_debug(DEBUG_CMD, "cmd configure (%d)", id);
 
+	if (WARN_ON_ONCE(len < sizeof(*acx)))
+		return -EIO;
+
 	acx->id = cpu_to_le16(id);
 
 	/* payload length, does not include any headers */