aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorPontus Fuchs <pontus.fuchs@gmail.com>2011-10-18 09:23:42 +0200
committerGreg Kroah-Hartman <gregkh@suse.de>2012-01-12 11:35:02 -0800
commita7b8c32b67b60fe9e8b53bb86bb7a04631e6e262 (patch)
treefa30a9638c3063b0b65bcfde0025a1438bee4e17
parent4b2bb3c98c134fb26332afd5ad54078c53a30c44 (diff)
downloadkernel_samsung_smdk4412-a7b8c32b67b60fe9e8b53bb86bb7a04631e6e262.tar.gz
kernel_samsung_smdk4412-a7b8c32b67b60fe9e8b53bb86bb7a04631e6e262.tar.bz2
kernel_samsung_smdk4412-a7b8c32b67b60fe9e8b53bb86bb7a04631e6e262.zip
wl12xx: Check buffer bound when processing nvs data
commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream. An nvs with malformed contents could cause the processing of the calibration data to read beyond the end of the buffer. Prevent this from happening by adding bound checking. Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com> Reviewed-by: Luciano Coelho <coelho@ti.com> Signed-off-by: Luciano Coelho <coelho@ti.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/net/wireless/wl12xx/boot.c14
1 files changed, 14 insertions, 0 deletions
diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
index b07f8b7e5f1..e0e16888fe8 100644
--- a/drivers/net/wireless/wl12xx/boot.c
+++ b/drivers/net/wireless/wl12xx/boot.c
@@ -328,6 +328,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
nvs_ptr += 3;
for (i = 0; i < burst_len; i++) {
+ if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
+ goto out_badnvs;
+
val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
| (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
@@ -339,6 +342,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
nvs_ptr += 4;
dest_addr += 4;
}
+
+ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+ goto out_badnvs;
}
/*
@@ -350,6 +356,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
*/
nvs_ptr = (u8 *)wl->nvs +
ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
+
+ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+ goto out_badnvs;
+
nvs_len -= nvs_ptr - (u8 *)wl->nvs;
/* Now we must set the partition correctly */
@@ -365,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
kfree(nvs_aligned);
return 0;
+
+out_badnvs:
+ wl1271_error("nvs data is malformed");
+ return -EILSEQ;
}
static void wl1271_boot_enable_interrupts(struct wl1271 *wl)