diff options
| author | Amitkumar Karwar <amit.karwar@redpinesignals.com> | 2017-07-11 19:57:52 +0530 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2017-07-28 17:27:19 +0300 |
| commit | 59f73e2ae185a6ab5c40f63657a83192bf054fb4 (patch) | |
| tree | a3eda328f17b242d230d634be96acabf6d28e721 | |
| parent | 523b724a769b69963ef46efa14b8b730b40419d5 (diff) | |
rsi: check length before USB read/write register
These checks are required. Otherwise we may end up getting
memory corruption if invalid length is passed.
Fixes: b97e9b94ad75c ("rsi: Add new host interface operations")
Signed-off-by: Amitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
| -rw-r--r-- | drivers/net/wireless/rsi/rsi_91x_usb.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c index 99a520afc7c5..3d33ce9ca2ba 100644 --- a/drivers/net/wireless/rsi/rsi_91x_usb.c +++ b/drivers/net/wireless/rsi/rsi_91x_usb.c @@ -166,6 +166,9 @@ static int rsi_usb_reg_read(struct usb_device *usbdev, if (!buf) return status; + if (len > RSI_USB_CTRL_BUF_SIZE) + return -EINVAL; + status = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), USB_VENDOR_REGISTER_READ, @@ -208,6 +211,9 @@ static int rsi_usb_reg_write(struct usb_device *usbdev, if (!usb_reg_buf) return status; + if (len > RSI_USB_CTRL_BUF_SIZE) + return -EINVAL; + usb_reg_buf[0] = (value & 0x00ff); usb_reg_buf[1] = (value & 0xff00) >> 8; usb_reg_buf[2] = 0x0; |