Commit 7a483656 authored by Dan Carpenter's avatar Dan Carpenter Committed by Kalle Valo
Browse files

wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() 



The simple_write_to_buffer() function will succeed if even a single
byte is initialized.  However, we need to initialize the whole buffer
to prevent information leaks.  Just use memdup_user().

Fixes: ff974e40 ("wil6210: debugfs interface to send raw WMI command")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarKalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/Ysg14NdKAZF/hcNG@kili
parent eaedf62f

drivers/net/wireless/ath/wil6210/debugfs.c

+4 −10
Original line number Diff line number Diff line
@@ -1012,18 +1012,12 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf, 
	u16 cmdid;

	int rc, rc1;



	if (cmdlen < 0)

	if (cmdlen < 0 || *ppos != 0)

		return -EINVAL;



	wmi = kmalloc(len, GFP_KERNEL);

	if (!wmi)

		return -ENOMEM;



	rc = simple_write_to_buffer(wmi, len, ppos, buf, len);

	if (rc < 0) {

		kfree(wmi);

		return rc;

	}

	wmi = memdup_user(buf, len);

	if (IS_ERR(wmi))

		return PTR_ERR(wmi);



	cmd = (cmdlen > 0) ? &wmi[1] : NULL;

	cmdid = le16_to_cpu(wmi->command_id);