diff options
| author | Luciano Coelho <luciano.coelho@intel.com> | 2014-11-10 10:25:17 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2014-11-12 00:31:16 +0300 |
| commit | f5b8f4790bb5dfd541f9d61589357ea6042cc668 (patch) | |
| tree | 550aa0c43dfdc44c6d6623bda54ec2142f420e9b /drivers/net/wireless/ti | |
| parent | 0d4b5c7c0892cb377cc71c388433425f598b902b (diff) | |
| download | linux-f5b8f4790bb5dfd541f9d61589357ea6042cc668.tar.xz | |
wlcore: check minimum buffer size in some cmd_send functions
Check for the minimum required buffer length in wlcore_cmd_send() and
wlcore_cmd_configure_failsafe. This ensures that we will never try to
use a buffer that is smaller than the required header.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ti')
| -rw-r--r-- | drivers/net/wireless/ti/wlcore/cmd.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c index 05604ee31224..5c6f3c84ad6f 100644 --- a/drivers/net/wireless/ti/wlcore/cmd.c +++ b/drivers/net/wireless/ti/wlcore/cmd.c @@ -64,6 +64,9 @@ static int __wlcore_cmd_send(struct wl1271 *wl, u16 id, void *buf, id != CMD_STOP_FWLOGGER)) return -EIO; + if (WARN_ON_ONCE(len < sizeof(*cmd))) + return -EIO; + cmd = buf; cmd->id = cpu_to_le16(id); cmd->status = 0; @@ -891,6 +894,9 @@ int wlcore_cmd_configure_failsafe(struct wl1271 *wl, u16 id, void *buf, wl1271_debug(DEBUG_CMD, "cmd configure (%d)", id); + if (WARN_ON_ONCE(len < sizeof(*acx))) + return -EIO; + acx->id = cpu_to_le16(id); /* payload length, does not include any headers */ |