summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2013-10-25 13:06:06 +0200
committerEmmanuel Grumbach <emmanuel.grumbach@intel.com>2013-11-25 23:00:19 +0200
commit60765a47a433d54e4744c285ad127f182dcd80aa (patch)
tree9c01d7cc7024968e0174ed410a20f92968e4c08a
parent9d8506cc2d7ea1f911c72c100193a3677f6668c3 (diff)
downloadop-kernel-dev-60765a47a433d54e4744c285ad127f182dcd80aa.zip
op-kernel-dev-60765a47a433d54e4744c285ad127f182dcd80aa.tar.gz
iwlwifi: mvm: check sta_id/drain values in debugfs
The station ID must be valid, if it's out of range then the array access may crash. Validate the station ID to the array length, and also validate the drain value even if that doesn't matter all that much. Cc: stable@vger.kernel.org Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver") Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
-rw-r--r--drivers/net/wireless/iwlwifi/mvm/debugfs.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 9864d71..a8fe6b4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -119,6 +119,10 @@ static ssize_t iwl_dbgfs_sta_drain_write(struct file *file,
if (sscanf(buf, "%d %d", &sta_id, &drain) != 2)
return -EINVAL;
+ if (sta_id < 0 || sta_id >= IWL_MVM_STATION_COUNT)
+ return -EINVAL;
+ if (drain < 0 || drain > 1)
+ return -EINVAL;
mutex_lock(&mvm->mutex);
OpenPOWER on IntegriCloud