leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity
e74fe2330a
linux/drivers/net/wireless/wl12xx
History
Luciano Coelho 09b661b332 wl12xx: fix potential buffer overflow in testmode nvs push 
We were allocating the size of the NVS file struct and not checking
whether the length of the buffer passed was correct before copying it
into the allocated memory.  This is a security hole because buffer
overflows can occur if the userspace passes a bigger file than what is
expected.

With this patch, we check if the size of the data passed from
userspace matches the size required.

This bug was introduced in 2.6.36.

Cc: stable@kernel.org
Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-04-04 15:22:12 -04:00
..
acx.c wl12xx: Correctly set up protection if non-GF STAs are present 2011-03-03 16:20:34 +02:00
acx.h wl12xx: AP-mode - fix race condition on sta connection 2011-02-23 11:14:55 +02:00
boot.c wl12xx: Do end-of-transactions transfers only if needed 2011-03-03 16:10:46 +02:00
boot.h wl12xx: Do end-of-transactions transfers only if needed 2011-03-03 16:10:46 +02:00
cmd.c wl12xx: wakeup chip from ELP during scan 2011-03-03 16:20:25 +02:00
cmd.h wl12xx: move to new firmware (6.1.3.50.49) 2011-02-08 22:51:42 -02:00
conf.h wl12xx: use the conf struct instead of macros for memory configuration 2011-02-08 22:51:42 -02:00
debugfs.c wl12xx: Switch to a threaded interrupt handler 2011-03-03 16:10:46 +02:00
debugfs.h wl1271: Change wl12xx Files Names 2010-11-22 16:45:09 +02:00
event.c wl12xx: move to new firmware (6.1.3.50.49) 2011-02-08 22:51:42 -02:00
event.h wl12xx: move to new firmware (6.1.3.50.49) 2011-02-08 22:51:42 -02:00
ini.h wl1271: Change wl12xx Files Names 2010-11-22 16:45:09 +02:00
init.c wl12xx: change type from u8 to int 2011-02-22 18:06:35 +02:00
init.h wl12xx: AP mode - init sequence 2011-01-24 22:11:48 +02:00
io.c wl1271: Add wl1271_load_firmware() and export some functions 2010-12-02 16:17:20 +02:00
io.h wl12xx: Switch to a threaded interrupt handler 2011-03-03 16:10:46 +02:00
Kconfig wl12xx: fix sdio_test kconfig/build errors 2011-02-21 15:39:56 -05:00
main.c wl12xx: Modify requested number of memory blocks 2011-03-03 16:12:57 +02:00
Makefile wl12xx_sdio_test: rename files to match current style 2010-12-15 17:09:27 +02:00
ps.c wl12xx: Switch to a threaded interrupt handler 2011-03-03 16:10:46 +02:00
ps.h wl12xx: Switch to a threaded interrupt handler 2011-03-03 16:10:46 +02:00
reg.h wl1271: Change wl12xx Files Names 2010-11-22 16:45:09 +02:00
rx.c wl12xx: Switch to a threaded interrupt handler 2011-03-03 16:10:46 +02:00
rx.h wl12xx: use standard ALIGN() macro 2011-02-23 11:11:19 +02:00
scan.c wl12xx: wakeup chip from ELP during scan 2011-03-03 16:20:25 +02:00
scan.h wl1271: Change wl12xx Files Names 2010-11-22 16:45:09 +02:00
sdio_test.c wl12xx_sdio_test: rename files to match current style 2010-12-15 17:09:27 +02:00
sdio.c wl12xx: fix module author's email address in the spi and sdio modules 2011-04-04 15:22:11 -04:00
spi.c wl12xx: fix module author's email address in the spi and sdio modules 2011-04-04 15:22:11 -04:00
testmode.c wl12xx: fix potential buffer overflow in testmode nvs push 2011-04-04 15:22:12 -04:00
testmode.h wl1271: Change wl12xx Files Names 2010-11-22 16:45:09 +02:00
tx.c wl12xx: Switch to a threaded interrupt handler 2011-03-03 16:10:46 +02:00
tx.h wl12xx: AP-mode - TX queue per link in AC 2011-02-23 11:14:56 +02:00
wl12xx_80211.h ieee80211: add IEEE80211_COUNTRY_STRING_LEN definition 2011-03-09 16:10:56 -05:00
wl12xx_platform_data.c wl12xx: add platform data passing support 2010-09-21 11:04:57 -04:00
wl12xx.h wl12xx: Avoid redundant TX work 2011-03-03 16:12:57 +02:00