diff options
| author |   Ivo van Doorn <ivdoorn@gmail.com> | 2009-01-23 17:03:24 +0100 |
|---|---|---|
| committer |   John W. Linville <linville@tuxdriver.com> | 2009-01-29 16:01:26 -0500 |
| commit | 9752a7bd7f36557f34283f5d75dfa32578437f08 (patch) | |
| tree | e936bbb3fb126c85d2ed3afd1e473c657776c647 /drivers/net/wireless/rt2x00/rt61pci.c | |
| parent | rt2x00: rt2x00_rev() should return u32 (diff) | |
| download | linux-dev-9752a7bd7f36557f34283f5d75dfa32578437f08.tar.xz linux-dev-9752a7bd7f36557f34283f5d75dfa32578437f08.zip | |
rt2x00: Restrict firmware file lengths
Add extra security to the drivers for firmware loading,
check the firmware file length before uploading it to
the hardware. Incorrect lengths might indicate a firmware
upgrade (which is not yet supported by the driver) or
otherwise incorrect firmware.
Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/rt2x00/rt61pci.c')
| -rw-r--r-- | drivers/net/wireless/rt2x00/rt61pci.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c index 3a7eccac8856..d81a8de9dc17 100644 --- a/drivers/net/wireless/rt2x00/rt61pci.c +++ b/drivers/net/wireless/rt2x00/rt61pci.c @@ -1199,6 +1199,11 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data, int i; u32 reg; + if (len != 8192) { + ERROR(rt2x00dev, "Invalid firmware file length (len=%zu)\n", len); + return -ENOENT; + } + /* * Wait for stable hardware. */ |