lkml.org 
[lkml]   [2022]   [Aug]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 346/779] wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 7a4836560a6198d245d5732e26f94898b12eb760 ]

    The simple_write_to_buffer() function will succeed if even a single
    byte is initialized. However, we need to initialize the whole buffer
    to prevent information leaks. Just use memdup_user().

    Fixes: ff974e408334 ("wil6210: debugfs interface to send raw WMI command")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
    Link: https://lore.kernel.org/r/Ysg14NdKAZF/hcNG@kili
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/wil6210/debugfs.c | 14 ++++----------
    1 file changed, 4 insertions(+), 10 deletions(-)

    diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
    index 4c944e595978..c6f8254cb21d 100644
    --- a/drivers/net/wireless/ath/wil6210/debugfs.c
    +++ b/drivers/net/wireless/ath/wil6210/debugfs.c
    @@ -1012,18 +1012,12 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf,
    u16 cmdid;
    int rc, rc1;

    - if (cmdlen < 0)
    + if (cmdlen < 0 || *ppos != 0)
    return -EINVAL;

    - wmi = kmalloc(len, GFP_KERNEL);
    - if (!wmi)
    - return -ENOMEM;
    -
    - rc = simple_write_to_buffer(wmi, len, ppos, buf, len);
    - if (rc < 0) {
    - kfree(wmi);
    - return rc;
    - }
    + wmi = memdup_user(buf, len);
    + if (IS_ERR(wmi))
    + return PTR_ERR(wmi);

    cmd = (cmdlen > 0) ? &wmi[1] : NULL;
    cmdid = le16_to_cpu(wmi->command_id);
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-08-15 21:00    [W:7.362 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site