linux-kernel - [PATCH] wl12xx: Fix for overflow while getting irq status

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Mon, 16 Jul 2012 13:44:24 -0500
From:	<manjunatha_halli@...com>
To:	<linux-media@...r.kernel.org>
CC:	<linux-kernel@...r.kernel.org>, <dan.carpenter@...cle.com>,
	Manjunatha Halli <x0130808@...com>
Subject: [PATCH] wl12xx: Fix for overflow while getting irq status

From: Manjunatha Halli <x0130808@...com>

->dlen is 8 bit long and so while memcpy there is a chance
that fmdev->irq_info.flag will overflow.

So this patch removes memcpy and instead copies the 16bit flag
register value from skb->data to fmdev->irq_info.flag directly.

Change-Id: I37604b91b2777ed9e56a7e1c1ecefe32e9024170
Signed-off-by: Manjunatha Halli <x0130808@...com>
---
 drivers/media/radio/wl128x/fmdrv_common.c |    8 +++-----
 1 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
index bf867a6..54c549b 100644
--- a/drivers/media/radio/wl128x/fmdrv_common.c
+++ b/drivers/media/radio/wl128x/fmdrv_common.c
@@ -584,18 +584,16 @@ static void fm_irq_send_flag_getcmd(struct fmdev *fmdev)
 static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev)
 {
 	struct sk_buff *skb;
-	struct fm_event_msg_hdr *fm_evt_hdr;
 
 	if (check_cmdresp_status(fmdev, &skb))
 		return;
 
-	fm_evt_hdr = (void *)skb->data;
-
 	/* Skip header info and copy only response data */
 	skb_pull(skb, sizeof(struct fm_event_msg_hdr));
-	memcpy(&fmdev->irq_info.flag, skb->data, fm_evt_hdr->dlen);
 
-	fmdev->irq_info.flag = be16_to_cpu(fmdev->irq_info.flag);
+	/* Copy 16 bit flag register value from skb->data */
+	fmdev->irq_info.flag = (u16) ((skb->data[0] << 8) | skb->data[1]);
+
 	fmdbg("irq: flag register(0x%x)\n", fmdev->irq_info.flag);
 
 	/* Continue next function in interrupt handler table */
-- 
1.7.4.1

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/