| Message ID | 1425655123-18916-1-git-send-email-arend@broadcom.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Kalle Valo |
| Headers | show |
On 03/06/15 16:18, Arend van Spriel wrote: > From: Pontus Fuchs<pontusf@broadcom.com> > > A short or malformed vendor command buffer could cause reads outside > the command buffer. > > Cc: stable@vger.kernel.org # v3.19 > Signed-off-by: Pontus Fuchs<pontusf@broadcom.com> > [arend@broadcom.com: slightly modified debug trace output] > Signed-off-by: Arend van Spriel<arend@broadcom.com> > --- Hi Kalle, Forgot to mention this is for v4.0 kernel. Regards, Arend > drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 ++++++++++++--- > 1 file changed, 12 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c > index 50cdf70..8eff275 100644 > --- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c > +++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c > @@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy, > void *dcmd_buf = NULL, *wr_pointer; > u16 msglen, maxmsglen = PAGE_SIZE - 0x100; > > - brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set, > - cmdhdr->len); > + if (len< sizeof(*cmdhdr)) { > + brcmf_err("vendor command too short: %d\n", len); > + return -EINVAL; > + } > > vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev); > ifp = vif->ifp; > > - len -= sizeof(struct brcmf_vndr_dcmd_hdr); > + brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd); > + > + if (cmdhdr->offset> len) { > + brcmf_err("bad buffer offset %d> %d\n", cmdhdr->offset, len); > + return -EINVAL; > + } > + > + len -= cmdhdr->offset; > ret_len = cmdhdr->len; > if (ret_len> 0 || len> 0) { > if (len> BRCMF_DCMD_MAXLEN) { -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
> From: Pontus Fuchs <pontusf@broadcom.com> > > A short or malformed vendor command buffer could cause reads outside > the command buffer. > > Cc: stable@vger.kernel.org # v3.19 > Signed-off-by: Pontus Fuchs <pontusf@broadcom.com> > [arend@broadcom.com: slightly modified debug trace output] > Signed-off-by: Arend van Spriel <arend@broadcom.com> Thanks, applied to wireless-drivers.git. Kalle Valo -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c index 50cdf70..8eff275 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c @@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy, void *dcmd_buf = NULL, *wr_pointer; u16 msglen, maxmsglen = PAGE_SIZE - 0x100; - brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set, - cmdhdr->len); + if (len < sizeof(*cmdhdr)) { + brcmf_err("vendor command too short: %d\n", len); + return -EINVAL; + } vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev); ifp = vif->ifp; - len -= sizeof(struct brcmf_vndr_dcmd_hdr); + brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd); + + if (cmdhdr->offset > len) { + brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len); + return -EINVAL; + } + + len -= cmdhdr->offset; ret_len = cmdhdr->len; if (ret_len > 0 || len > 0) { if (len > BRCMF_DCMD_MAXLEN) {