mirror of
https://github.com/torvalds/linux.git
synced 2026-04-27 19:12:29 -04:00
fe9e4d0c39
Fix the following copy overflow warning identified by Smatch checker.
drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame()
error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)
This patch introduces size check before accessing the memory buffer.
The checks are base on the WID type of received data from the firmware.
For WID string configuration, the size limit is determined by individual
element size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field
of 'struct wilc_cfg_str'.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/linux-wireless/aLFbr9Yu9j_TQTey@stanley.mountain
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com>
Link: https://patch.msgid.link/20250829225829.5423-1-ajay.kathat@microchip.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
56 lines
1.1 KiB
C
56 lines
1.1 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Copyright (c) 2012 - 2018 Microchip Technology Inc., and its subsidiaries.
|
|
* All rights reserved.
|
|
*/
|
|
|
|
#ifndef WILC_WLAN_CFG_H
|
|
#define WILC_WLAN_CFG_H
|
|
|
|
struct wilc_cfg_byte {
|
|
u16 id;
|
|
u8 val;
|
|
};
|
|
|
|
struct wilc_cfg_hword {
|
|
u16 id;
|
|
u16 val;
|
|
};
|
|
|
|
struct wilc_cfg_word {
|
|
u16 id;
|
|
u32 val;
|
|
};
|
|
|
|
struct wilc_cfg_str {
|
|
u16 id;
|
|
u16 len;
|
|
u8 *str;
|
|
};
|
|
|
|
struct wilc_cfg_str_vals {
|
|
u8 mac_address[8];
|
|
u8 firmware_version[130];
|
|
u8 assoc_rsp[WILC_MAX_ASSOC_RESP_FRAME_SIZE];
|
|
};
|
|
|
|
struct wilc_cfg {
|
|
struct wilc_cfg_byte *b;
|
|
struct wilc_cfg_hword *hw;
|
|
struct wilc_cfg_word *w;
|
|
struct wilc_cfg_str *s;
|
|
struct wilc_cfg_str_vals *str_vals;
|
|
};
|
|
|
|
struct wilc;
|
|
int wilc_wlan_cfg_set_wid(u8 *frame, u32 offset, u16 id, u8 *buf, int size);
|
|
int wilc_wlan_cfg_get_wid(u8 *frame, u32 offset, u16 id);
|
|
int wilc_wlan_cfg_get_val(struct wilc *wl, u16 wid, u8 *buffer,
|
|
u32 buffer_size);
|
|
void wilc_wlan_cfg_indicate_rx(struct wilc *wilc, u8 *frame, int size,
|
|
struct wilc_cfg_rsp *rsp);
|
|
int wilc_wlan_cfg_init(struct wilc *wl);
|
|
void wilc_wlan_cfg_deinit(struct wilc *wl);
|
|
|
|
#endif
|