Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 60c99834 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() 



[ Upstream commit 7a4836560a6198d245d5732e26f94898b12eb760 ]

The simple_write_to_buffer() function will succeed if even a single
byte is initialized.  However, we need to initialize the whole buffer
to prevent information leaks.  Just use memdup_user().

Fixes: ff974e40 ("wil6210: debugfs interface to send raw WMI command")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarKalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/Ysg14NdKAZF/hcNG@kili


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 72d9ce5b

drivers/net/wireless/ath/wil6210/debugfs.c

+4 −10
Original line number Original line Diff line number Diff line
@@ -1023,18 +1023,12 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, 
	u16 cmdid;

	u16 cmdid;

	int rc, rc1;

	int rc, rc1;





	if (cmdlen < 0)

	if (cmdlen < 0 || *ppos != 0)

		return -EINVAL;

		return -EINVAL;





	wmi = kmalloc(len, GFP_KERNEL);

	wmi = memdup_user(buf, len);

	if (!wmi)

	if (IS_ERR(wmi))

		return -ENOMEM;

		return PTR_ERR(wmi);



	rc = simple_write_to_buffer(wmi, len, ppos, buf, len);

	if (rc < 0) {

		kfree(wmi);

		return rc;

	}





	cmd = (cmdlen > 0) ? &wmi[1] : NULL;

	cmd = (cmdlen > 0) ? &wmi[1] : NULL;

	cmdid = le16_to_cpu(wmi->command_id);

	cmdid = le16_to_cpu(wmi->command_id);