summaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/ti
diff options
context:
space:
mode:
authorLuciano Coelho <luciano.coelho@intel.com>2014-11-10 09:25:17 +0200
committerJohn W. Linville <linville@tuxdriver.com>2014-11-11 16:31:16 -0500
commitf5b8f4790bb5dfd541f9d61589357ea6042cc668 (patch)
tree550aa0c43dfdc44c6d6623bda54ec2142f420e9b /drivers/net/wireless/ti
parent0d4b5c7c0892cb377cc71c388433425f598b902b (diff)
downloadop-kernel-dev-f5b8f4790bb5dfd541f9d61589357ea6042cc668.zip
op-kernel-dev-f5b8f4790bb5dfd541f9d61589357ea6042cc668.tar.gz
wlcore: check minimum buffer size in some cmd_send functions
Check for the minimum required buffer length in wlcore_cmd_send() and wlcore_cmd_configure_failsafe. This ensures that we will never try to use a buffer that is smaller than the required header. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Luciano Coelho <luciano.coelho@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ti')
-rw-r--r--drivers/net/wireless/ti/wlcore/cmd.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 05604ee..5c6f3c8 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -64,6 +64,9 @@ static int __wlcore_cmd_send(struct wl1271 *wl, u16 id, void *buf,
id != CMD_STOP_FWLOGGER))
return -EIO;
+ if (WARN_ON_ONCE(len < sizeof(*cmd)))
+ return -EIO;
+
cmd = buf;
cmd->id = cpu_to_le16(id);
cmd->status = 0;
@@ -891,6 +894,9 @@ int wlcore_cmd_configure_failsafe(struct wl1271 *wl, u16 id, void *buf,
wl1271_debug(DEBUG_CMD, "cmd configure (%d)", id);
+ if (WARN_ON_ONCE(len < sizeof(*acx)))
+ return -EIO;
+
acx->id = cpu_to_le16(id);
/* payload length, does not include any headers */
OpenPOWER on IntegriCloud