lkml.org 
[lkml]   [2012]   [Jan]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[09/49] wl12xx: Validate FEM index from ini file and FW
    3.2-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Pontus Fuchs <pontus.fuchs@gmail.com>

    commit 2131d3c2f99b081806fdae7662c92fe6acda52af upstream.

    Check for out of bound FEM index to prevent reading beyond ini
    memory end.

    Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
    Reviewed-by: Luciano Coelho <coelho@ti.com>
    Signed-off-by: Luciano Coelho <coelho@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/net/wireless/wl12xx/cmd.c | 22 ++++++++++++++++++++++
    1 file changed, 22 insertions(+)

    --- a/drivers/net/wireless/wl12xx/cmd.c
    +++ b/drivers/net/wireless/wl12xx/cmd.c
    @@ -120,6 +120,11 @@ int wl1271_cmd_general_parms(struct wl12
    if (!wl->nvs)
    return -ENODEV;

    + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
    + wl1271_warning("FEM index from INI out of bounds");
    + return -EINVAL;
    + }
    +
    gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
    if (!gen_parms)
    return -ENOMEM;
    @@ -143,6 +148,12 @@ int wl1271_cmd_general_parms(struct wl12
    gp->tx_bip_fem_manufacturer =
    gen_parms->general_params.tx_bip_fem_manufacturer;

    + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
    + wl1271_warning("FEM index from FW out of bounds");
    + ret = -EINVAL;
    + goto out;
    + }
    +
    wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
    answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);

    @@ -162,6 +173,11 @@ int wl128x_cmd_general_parms(struct wl12
    if (!wl->nvs)
    return -ENODEV;

    + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
    + wl1271_warning("FEM index from ini out of bounds");
    + return -EINVAL;
    + }
    +
    gen_parms = kzalloc(sizeof(*gen_parms), GFP_KERNEL);
    if (!gen_parms)
    return -ENOMEM;
    @@ -186,6 +202,12 @@ int wl128x_cmd_general_parms(struct wl12
    gp->tx_bip_fem_manufacturer =
    gen_parms->general_params.tx_bip_fem_manufacturer;

    + if (gp->tx_bip_fem_manufacturer >= WL1271_INI_FEM_MODULE_COUNT) {
    + wl1271_warning("FEM index from FW out of bounds");
    + ret = -EINVAL;
    + goto out;
    + }
    +
    wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
    answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);




    \
     
     \ /
      Last update: 2012-01-11 00:07    [W:0.020 / U:34.432 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site