iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wlcore: check minimum buffer size in some cmd_send functions

Browse Source 
Check for the minimum required buffer length in wlcore_cmd_send() and
wlcore_cmd_configure_failsafe.  This ensures that we will never try to
use a buffer that is smaller than the required header.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Luciano Coelho 2014-11-10 09:25:17 +02:00 committed by John W. Linville
parent 0d4b5c7c08
commit f5b8f4790b
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/net/wireless/ti/wlcore/cmd.c
View File

@ -64,6 +64,9 @@ static int __wlcore_cmd_send(struct wl1271 *wl, u16 id, void *buf,
id != CMD_STOP_FWLOGGER)) id != CMD_STOP_FWLOGGER))
return -EIO; return -EIO;
if (WARN_ON_ONCE(len < sizeof(*cmd)))
return -EIO;
cmd = buf; cmd = buf;
cmd->id = cpu_to_le16(id); cmd->id = cpu_to_le16(id);
cmd->status = 0; cmd->status = 0;
@ -891,6 +894,9 @@ int wlcore_cmd_configure_failsafe(struct wl1271 *wl, u16 id, void *buf,
wl1271_debug(DEBUG_CMD, "cmd configure (%d)", id); wl1271_debug(DEBUG_CMD, "cmd configure (%d)", id);
if (WARN_ON_ONCE(len < sizeof(*acx)))
return -EIO;
acx->id = cpu_to_le16(id); acx->id = cpu_to_le16(id);
/* payload length, does not include any headers */ /* payload length, does not include any headers */