]> www.infradead.org Git - users/dwmw2/linux.git/commit
media: wl128x: prevent two potential buffer overflows
authorDan Carpenter <dan.carpenter@oracle.com>
Tue, 26 Mar 2019 05:12:07 +0000 (01:12 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 31 May 2019 13:47:32 +0000 (06:47 -0700)
commit2f6e78daa0d02abb4f6ccd3d5893a670da72e946
tree9ba3c5af159b41c8bf95a27ab672e6d27f2e3400
parent9d561c9546f0add7b9e238fd23d68f3065ba24d6
media: wl128x: prevent two potential buffer overflows

[ Upstream commit 9c2ccc324b3a6cbc865ab8b3e1a09e93d3c8ade9 ]

Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen"
can copy up to 255 bytes and we only have room for two bytes.  Even
if this comes from the firmware and we trust it, the new policy
generally is just to fix it as kernel hardenning.

I can't test this code so I tried to be very conservative.  I considered
not allowing "evt_hdr->dlen == 1" because it doesn't initialize the
whole variable but in the end I decided to allow it and manually
initialized "asic_id" and "asic_ver" to zero.

Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/media/radio/wl128x/fmdrv_common.c