| Message ID | 20180814090747.a7gcph2wa6abyimi@kili.mountain (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 3348ef6a6a126706d6a73ed40c18d8033df72783 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | libertas_tf: prevent underflow in process_cmdrequest() | expand |
Dan Carpenter <dan.carpenter@oracle.com> wrote: > If recvlength is less than MESSAGE_HEADER_LEN (4) we would end up > corrupting memory. > > Fixes: c305a19a0d0a ("libertas_tf: usb specific functions") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Patch applied to wireless-drivers-next.git, thanks. 3348ef6a6a12 libertas_tf: prevent underflow in process_cmdrequest()
diff --git a/drivers/net/wireless/marvell/libertas_tf/if_usb.c b/drivers/net/wireless/marvell/libertas_tf/if_usb.c index e92fc5001171..789337ea676a 100644 --- a/drivers/net/wireless/marvell/libertas_tf/if_usb.c +++ b/drivers/net/wireless/marvell/libertas_tf/if_usb.c @@ -605,9 +605,10 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff, { unsigned long flags; - if (recvlength > LBS_CMD_BUFFER_SIZE) { + if (recvlength < MESSAGE_HEADER_LEN || + recvlength > LBS_CMD_BUFFER_SIZE) { lbtf_deb_usbd(&cardp->udev->dev, - "The receive buffer is too large\n"); + "The receive buffer is invalid: %d\n", recvlength); kfree_skb(skb); return; }
If recvlength is less than MESSAGE_HEADER_LEN (4) we would end up corrupting memory. Fixes: c305a19a0d0a ("libertas_tf: usb specific functions") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- This is from static analysis. I'm not positive that this is a real bug, but it's harmless to check.