Skip to content

Commit

Permalink
wl12xx: fix potential buffer overflow in testmode nvs push
Browse files Browse the repository at this point in the history
We were allocating the size of the NVS file struct and not checking
whether the length of the buffer passed was correct before copying it
into the allocated memory.  This is a security hole because buffer
overflows can occur if the userspace passes a bigger file than what is
expected.

With this patch, we check if the size of the data passed from
userspace matches the size required.

This bug was introduced in 2.6.36.

Cc: stable@kernel.org
Reported-by: Ido Yariv <ido@wizery.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
  • Loading branch information
Luciano Coelho authored and John W. Linville committed Apr 4, 2011
1 parent 0235357 commit 09b661b
Showing 1 changed file with 4 additions and 1 deletion.
5 changes: 4 additions & 1 deletion drivers/net/wireless/wl12xx/testmode.c
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,10 @@ static int wl1271_tm_cmd_nvs_push(struct wl1271 *wl, struct nlattr *tb[])

kfree(wl->nvs);

wl->nvs = kzalloc(sizeof(struct wl1271_nvs_file), GFP_KERNEL);
if (len != sizeof(struct wl1271_nvs_file))
return -EINVAL;

wl->nvs = kzalloc(len, GFP_KERNEL);
if (!wl->nvs) {
wl1271_error("could not allocate memory for the nvs file");
ret = -ENOMEM;
Expand Down

0 comments on commit 09b661b

Please sign in to comment.