shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-04 02:02:28 +09:00
Code Issues Packages Projects Releases Wiki Activity

iwlwifi: mvm: check sta_id/drain values in debugfs

Browse Source 
commit 60765a47a4 upstream.

The station ID must be valid, if it's out of range then
the array access may crash. Validate the station ID to
the array length, and also validate the drain value even
if that doesn't matter all that much.

Fixes: 8ca151b568 ("iwlwifi: add the MVM driver")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johannes Berg
2013-10-25 13:06:06 +02:00
committed by Greg Kroah-Hartman
parent 42beb20471
commit 555214ae0d
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/wireless/iwlwifi/mvm/debugfs.c
View File

@@ -119,6 +119,10 @@ static ssize_t iwl_dbgfs_sta_drain_write(struct file *file,
if (sscanf(buf, "%d %d", &sta_id, &drain) != 2)
return -EINVAL;
if (sta_id < 0 || sta_id >= IWL_MVM_STATION_COUNT)
return -EINVAL;
if (drain < 0 || drain > 1)
return -EINVAL;
mutex_lock(&mvm->mutex);