redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

staging: gdm724x: fix a couple array overflows 

The find_dev_index() function is frustrating.  If you give it an invalid
index then it returns 0.  That was the intent except there is an
off-by-one so it can return MAX_NIC_TYPE which is one higher than we
want.

There is one caller which had a sanity check to catch invalid returns,
but the other two callers assumed that index was valid.

My feeling is that when we are given invalid indexes, that should be
treated like an error and we abandon what we were doing.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
hifive-unleashed-5.1
Dan Carpenter 2017-02-08 10:18:08 +03:00 committed by Greg Kroah-Hartman
parent 57e60850e7
commit cd47e4d69a
1 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/staging/gdm724x/gdm_lte.c
View File

@ -560,13 +560,13 @@ void gdm_lte_event_exit(void)
}
}
static u8 find_dev_index(u32 nic_type)
static int find_dev_index(u32 nic_type)
{
u8 index;
index = (u8)(nic_type & 0x0000000f);
if (index > MAX_NIC_TYPE)
index = 0;
if (index >= MAX_NIC_TYPE)
return -EINVAL;
return index;
}
@ -695,7 +695,7 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
u16 hci_len;
u16 cmd_evt;
u32 nic_type;
u8 index;
int index;
hci_len = gdm_dev16_to_cpu(endian, multi_sdu->len);
num_packet = gdm_dev16_to_cpu(endian, multi_sdu->num_packet);
@ -717,13 +717,13 @@ static void gdm_lte_multi_sdu_pkt(struct phy_dev *phy_dev, char *buf, int len)
}
index = find_dev_index(nic_type);
if (index < MAX_NIC_TYPE) {
dev = phy_dev->dev[index];
gdm_lte_netif_rx(dev, (char *)sdu->data,
(int)(hci_len - 12), nic_type);
} else {
if (index < 0) {
pr_err("rx sdu invalid nic_type :%x\n", nic_type);
return;
}
dev = phy_dev->dev[index];
gdm_lte_netif_rx(dev, (char *)sdu->data,
(int)(hci_len - 12), nic_type);
data += ((hci_len + 3) & 0xfffc) + HCI_HEADER_SIZE;
}
@ -763,7 +763,7 @@ static int gdm_lte_receive_pkt(struct phy_dev *phy_dev, char *buf, int len)
int ret = 0;
u16 cmd_evt;
u32 nic_type;
u8 index;
int index;
if (!len)
return ret;
@ -779,6 +779,8 @@ static int gdm_lte_receive_pkt(struct phy_dev *phy_dev, char *buf, int len)
sdu = (struct sdu *)hci->data;
nic_type = gdm_dev32_to_cpu(endian, sdu->nic_type);
index = find_dev_index(nic_type);
if (index < 0)
return index;
dev = phy_dev->dev[index];
gdm_lte_netif_rx(dev, hci->data, len, nic_type);
break;
@ -794,6 +796,8 @@ static int gdm_lte_receive_pkt(struct phy_dev *phy_dev, char *buf, int len)
pdn_table = (struct hci_pdn_table_ind *)buf;
nic_type = gdm_dev32_to_cpu(endian, pdn_table->nic_type);
index = find_dev_index(nic_type);
if (index < 0)
return index;
dev = phy_dev->dev[index];
gdm_lte_pdn_table(dev, buf, len);
/* Fall through */