wl12xx: Check buffer bound when processing nvs data

commit f6efe96edd9c41c624c8f4ddbc4930c1a2d8f1e1 upstream.

An nvs with malformed contents could cause the processing of the
calibration data to read beyond the end of the buffer. Prevent this
from happening by adding bound checking.

Signed-off-by: Pontus Fuchs <pontus.fuchs@gmail.com>
Reviewed-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c
index 6813379149767ea4c6236d6b43a0f1f0c219c8d1..a7b327d2e41b43e9551ed6ed990cac37799e3d4d 100644 (file)
--- a/drivers/net/wireless/wl12xx/boot.c
+++ b/drivers/net/wireless/wl12xx/boot.c
@@ -347,6 +347,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
                nvs_ptr += 3;
 
                for (i = 0; i < burst_len; i++) {
+                       if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len)
+                               goto out_badnvs;
+
                        val = (nvs_ptr[0] | (nvs_ptr[1] << 8)
                               | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24));
 
@@ -358,6 +361,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
                        nvs_ptr += 4;
                        dest_addr += 4;
                }
+
+               if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+                       goto out_badnvs;
        }
 
        /*
@@ -369,6 +375,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
         */
        nvs_ptr = (u8 *)wl->nvs +
                        ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4);
+
+       if (nvs_ptr >= (u8 *) wl->nvs + nvs_len)
+               goto out_badnvs;
+
        nvs_len -= nvs_ptr - (u8 *)wl->nvs;
 
        /* Now we must set the partition correctly */
@@ -384,6 +394,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl)
 
        kfree(nvs_aligned);
        return 0;
+
+out_badnvs:
+       wl1271_error("nvs data is malformed");
+       return -EILSEQ;
 }
 
 static void wl1271_boot_enable_interrupts(struct wl1271 *wl)