Merge "wcnss: fix the buffer overflow in MAC address store sysfs" (12959757) · Commits · e / devices / android_kernel_sony_msm8998

drivers/net/wireless/wcnss/wcnss_wlan.c

+16 −9

Original line number	Diff line number	Diff line
		/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
		/* Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 and
		@@ -192,6 +192,8 @@ static DEFINE_SPINLOCK(reg_spinlock);
		#define WCNSS_USR_WLAN_MAC_ADDR (WCNSS_USR_CTRL_MSG_START + 3)

		#define MAC_ADDRESS_STR "%02x:%02x:%02x:%02x:%02x:%02x"
		#define SHOW_MAC_ADDRESS_STR "%02x:%02x:%02x:%02x:%02x:%02x\n"
		#define WCNSS_USER_MAC_ADDR_LENGTH 18

		/* message types */
		#define WCNSS_CTRL_MSG_START 0x01000000
		@@ -427,23 +429,28 @@ static struct {
		static ssize_t wcnss_wlan_macaddr_store(struct device *dev,
		struct device_attribute attr, const char buf, size_t count)
		{
		char macAddr[WLAN_MAC_ADDR_SIZE];
		int index;
		int macAddr[WLAN_MAC_ADDR_SIZE];

		if (!penv)
		return -ENODEV;

		pr_debug("%s: Receive MAC Addr From user space: %s\n", __func__, buf);
		if (strlen(buf) != WCNSS_USER_MAC_ADDR_LENGTH) {
		dev_err(dev, "%s: Invalid MAC addr length\n", __func__);
		return -EINVAL;
		}

		if (WLAN_MAC_ADDR_SIZE != sscanf(buf, MAC_ADDRESS_STR,
		(int )&macAddr[0], (int )&macAddr[1],
		(int )&macAddr[2], (int )&macAddr[3],
		(int )&macAddr[4], (int )&macAddr[5])) {

		&macAddr[0], &macAddr[1], &macAddr[2],
		&macAddr[3], &macAddr[4], &macAddr[5])) {
		pr_err("%s: Failed to Copy MAC\n", __func__);
		return -EINVAL;
		}

		memcpy(penv->wlan_nv_macAddr, macAddr, sizeof(penv->wlan_nv_macAddr));
		for (index = 0; index < WLAN_MAC_ADDR_SIZE; index++) {
		memcpy(&penv->wlan_nv_macAddr[index],
		(char *)&macAddr[index], sizeof(char));
		}

		pr_info("%s: Write MAC Addr:" MAC_ADDRESS_STR "\n", __func__,
		penv->wlan_nv_macAddr[0], penv->wlan_nv_macAddr[1],
		@@ -459,7 +466,7 @@ static ssize_t wcnss_wlan_macaddr_show(struct device *dev,
		if (!penv)
		return -ENODEV;

		return scnprintf(buf, PAGE_SIZE, MAC_ADDRESS_STR,
		return scnprintf(buf, PAGE_SIZE, SHOW_MAC_ADDRESS_STR,
		penv->wlan_nv_macAddr[0], penv->wlan_nv_macAddr[1],
		penv->wlan_nv_macAddr[2], penv->wlan_nv_macAddr[3],
		penv->wlan_nv_macAddr[4], penv->wlan_nv_macAddr[5]);