Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 370672f7 authored by Balvinder Singh's avatar Balvinder Singh Committed by Gerrit - the friendly Code Review server
Browse files

[Bluetooth] - Fix for checking proper user-supplied buffers 



During patch download of devices, size validations & zero alloc
the buffers to ensure values passed are in range

CRs-fixed: 2084692
Change-Id: Ie1cd76fe68766d6d12d7262202e48c18ebe42274
Signed-off-by: default avatarBalvinder Singh <bpsingh@codeaurora.org>
parent 58df09ae

drivers/bluetooth/ath3k.c

+17 −4
Original line number Diff line number Diff line
@@ -212,15 +212,28 @@ static int ath3k_load_firmware(struct usb_device *udev, 
				const struct firmware *firmware)

{

	u8 *send_buf;

	int len = 0;

	int err, pipe, size, sent = 0;

	int count = firmware->size;

	int err, pipe, len, size, sent = 0;

	int count;



	BT_DBG("udev %p", udev);



	if (!firmware || !firmware->data || firmware->size <= 0) {

		err = -EINVAL;

		BT_ERR("Not a valid FW file");

		return err;

	}



	count = firmware->size;



	if (count < FW_HDR_SIZE) {

		err = -EINVAL;

		BT_ERR("ath3k loading invalid size of file");

		return err;

	}



	pipe = usb_sndctrlpipe(udev, 0);



	send_buf = kmalloc(BULK_SIZE, GFP_KERNEL);

	send_buf = kzalloc(BULK_SIZE, GFP_KERNEL);

	if (!send_buf) {

		BT_ERR("Can't allocate memory chunk for firmware");

		return -ENOMEM;