wil6210: fix length check in __wmi_send

Browse source

The current length check:
sizeof(cmd) + len > r->entry_size
will allow very large values of len (> U16_MAX - sizeof(cmd))
and can cause a buffer overflow. Fix the check to cover this case.
In addition, ensure the mailbox entry_size is not too small,
since this can also bypass the above check.

Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

...

This commit is contained in:

Lior David 2017-11-14 15:25:37 +02:00 • committed by Kalle Valo

parent 144a12a6d8

commit 26a6d52748

2 changed files with 22 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

22

drivers/net/wireless/ath/wil6210/interrupt.c

View file

2

drivers/net/wireless/ath/wil6210/wmi.c

View file