diff options
| author |   Pontus Fuchs <pontusf@broadcom.com> | 2015-03-06 16:18:41 +0100 |
|---|---|---|
| committer |   Kalle Valo <kvalo@codeaurora.org> | 2015-03-07 10:52:30 +0200 |
| commit | 3f1615340acea54e21f4b9d4d65921540dca84b2 (patch) | |
| tree | 36dd5fa76bba565410b585c491719c8197fc18f9 /drivers | |
| parent | Merge tag 'iwlwifi-for-kalle-2015-03-05' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes (diff) | |
| download | linux-dev-3f1615340acea54e21f4b9d4d65921540dca84b2.tar.xz linux-dev-3f1615340acea54e21f4b9d4d65921540dca84b2.zip | |
brcmfmac: Perform bound checking on vendor command buffer
A short or malformed vendor command buffer could cause reads outside
the command buffer.
Cc: stable@vger.kernel.org # v3.19
Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
[arend@broadcom.com: slightly modified debug trace output]
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c index 50cdf7090198..8eff2753abad 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c @@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy, void *dcmd_buf = NULL, *wr_pointer; u16 msglen, maxmsglen = PAGE_SIZE - 0x100; - brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set, - cmdhdr->len); + if (len < sizeof(*cmdhdr)) { + brcmf_err("vendor command too short: %d\n", len); + return -EINVAL; + } vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev); ifp = vif->ifp; - len -= sizeof(struct brcmf_vndr_dcmd_hdr); + brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd); + + if (cmdhdr->offset > len) { + brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len); + return -EINVAL; + } + + len -= cmdhdr->offset; ret_len = cmdhdr->len; if (ret_len > 0 || len > 0) { if (len > BRCMF_DCMD_MAXLEN) { |