mirror of
https://git.yoctoproject.org/meta-ti
synced 2026-10-22 05:38:17 +00:00
Koen Kooi
c4eefd7530
Runtime tested on a beaglebone A3 Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
69 lines
2.0 KiB
Diff
69 lines
2.0 KiB
Diff
From bcd7880977c293b60ae6dbae4264d6c47be08fb9 Mon Sep 17 00:00:00 2001
|
|
From: Pontus Fuchs <pontus.fuchs@gmail.com>
|
|
Date: Tue, 18 Oct 2011 09:23:42 +0200
|
|
Subject: [PATCH 10/49] wl12xx: Check buffer bound when processing nvs data
|
|
|
|
commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream.
|
|
|
|
An nvs with malformed contents could cause the processing of the
|
|
calibration data to read beyond the end of the buffer. Prevent this
|
|
from happening by adding bound checking.
|
|
|
|
Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
|
|
Reviewed-by: Luciano Coelho <coelho@ti.com>
|
|
Signed-off-by: Luciano Coelho <coelho@ti.com>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
|
|
---
|
|
drivers/net/wireless/wl12xx/boot.c | 14 ++++++++++++++
|
|
1 files changed, 14 insertions(+), 0 deletions(-)
|
|
|
|
diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
|
|
index 6813379..a7b327d 100644
|
|
--- a/drivers/net/wireless/wl12xx/boot.c
|
|
+++ b/drivers/net/wireless/wl12xx/boot.c
|
|
@@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
|
|
nvs_ptr += 3;
|
|
|
|
for (i = 0; i < burst_len; i++) {
|
|
+ if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
|
|
+ goto out_badnvs;
|
|
+
|
|
val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
|
|
| (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
|
|
|
|
@@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
|
|
nvs_ptr += 4;
|
|
dest_addr += 4;
|
|
}
|
|
+
|
|
+ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
|
|
+ goto out_badnvs;
|
|
}
|
|
|
|
/*
|
|
@@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
|
|
*/
|
|
nvs_ptr = (u8 *)wl->nvs +
|
|
ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
|
|
+
|
|
+ if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
|
|
+ goto out_badnvs;
|
|
+
|
|
nvs_len -= nvs_ptr - (u8 *)wl->nvs;
|
|
|
|
/* Now we must set the partition correctly */
|
|
@@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
|
|
|
|
kfree(nvs_aligned);
|
|
return 0;
|
|
+
|
|
+out_badnvs:
|
|
+ wl1271_error("nvs data is malformed");
|
|
+ return -EILSEQ;
|
|
}
|
|
|
|
static void wl1271_boot_enable_interrupts(struct wl1271 *wl)
|
|
--
|
|
1.7.7.4
|
|
|