diff options
| author | Ryan Hsu <ryanhsu@codeaurora.org> | 2018-01-16 11:43:49 +0200 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2018-01-16 16:31:12 +0200 |
| commit | 9ed4f91628737c820af6a1815b65bc06bd31518f (patch) | |
| tree | f4d27a0a835278f20965857a1939a945303f3621 /drivers/net/wireless/ath | |
| parent | 3153b68e4d1a0b6c9d75cf4fe419229890ee15d5 (diff) | |
| download | linux-stable-9ed4f91628737c820af6a1815b65bc06bd31518f.tar.gz linux-stable-9ed4f91628737c820af6a1815b65bc06bd31518f.tar.bz2 linux-stable-9ed4f91628737c820af6a1815b65bc06bd31518f.zip | |
ath10k: add sanity check to ie_len before parsing fw/board ie
Validate ie_len after the alignment padding before access the buffer
to avoid potential overflow.
Signed-off-by: Ryan Hsu <ryanhsu@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/ath')
| -rw-r--r-- | drivers/net/wireless/ath/ath10k/core.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c index fe9341c97f31..c60d91328b5f 100644 --- a/drivers/net/wireless/ath/ath10k/core.c +++ b/drivers/net/wireless/ath/ath10k/core.c @@ -1276,7 +1276,10 @@ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar, len -= sizeof(*hdr); data = hdr->data; - if (len < ALIGN(ie_len, 4)) { + /* jump over the padding */ + ie_len = ALIGN(ie_len, 4); + + if (len < ie_len) { ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n", ie_id, ie_len, len); ret = -EINVAL; @@ -1315,8 +1318,6 @@ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar, goto out; } - /* jump over the padding */ - ie_len = ALIGN(ie_len, 4); len -= ie_len; data += ie_len; @@ -1448,6 +1449,9 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name, len -= sizeof(*hdr); data += sizeof(*hdr); + /* jump over the padding */ + ie_len = ALIGN(ie_len, 4); + if (len < ie_len) { ath10k_err(ar, "invalid length for FW IE %d (%zu < %zu)\n", ie_id, len, ie_len); @@ -1553,9 +1557,6 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name, break; } - /* jump over the padding */ - ie_len = ALIGN(ie_len, 4); - len -= ie_len; data += ie_len; } |