leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ath10k: add sanity check to ie_len before parsing fw/board ie

Browse Source 
Validate ie_len after the alignment padding before access the buffer
to avoid potential overflow.

Signed-off-by: Ryan Hsu <ryanhsu@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
This commit is contained in:
Ryan Hsu 2018-01-16 11:43:49 +02:00 committed by Kalle Valo
parent 3153b68e4d
commit 9ed4f91628
1 changed files with 7 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/net/wireless/ath/ath10k/core.c
View File

@ -1276,7 +1276,10 @@ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar,
len -= sizeof(*hdr); len -= sizeof(*hdr);
data = hdr->data; data = hdr->data;
if (len < ALIGN(ie_len, 4)) { /* jump over the padding */
ie_len = ALIGN(ie_len, 4);
if (len < ie_len) {
ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n", ath10k_err(ar, "invalid length for board ie_id %d ie_len %zu len %zu\n",
ie_id, ie_len, len); ie_id, ie_len, len);
ret = -EINVAL; ret = -EINVAL;
@ -1315,8 +1318,6 @@ static int ath10k_core_fetch_board_data_api_n(struct ath10k *ar,
goto out; goto out;
} }
/* jump over the padding */
ie_len = ALIGN(ie_len, 4);
len -= ie_len; len -= ie_len;
data += ie_len; data += ie_len;
@ -1448,6 +1449,9 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name,
len -= sizeof(*hdr); len -= sizeof(*hdr);
data += sizeof(*hdr); data += sizeof(*hdr);
/* jump over the padding */
ie_len = ALIGN(ie_len, 4);
if (len < ie_len) { if (len < ie_len) {
ath10k_err(ar, "invalid length for FW IE %d (%zu < %zu)\n", ath10k_err(ar, "invalid length for FW IE %d (%zu < %zu)\n",
ie_id, len, ie_len); ie_id, len, ie_len);
@ -1553,9 +1557,6 @@ int ath10k_core_fetch_firmware_api_n(struct ath10k *ar, const char *name,
break; break;
} }
/* jump over the padding */
ie_len = ALIGN(ie_len, 4);
len -= ie_len; len -= ie_len;
data += ie_len; data += ie_len;
} }