Commit 968d02c6 authored by Dmitry Antipov's avatar Dmitry Antipov Committed by Kalle Valo
Browse files

wifi: mwifiex: handle possible sscanf() errors 



Return -EINVAL on possible 'sscanf()' errors in
'mwifiex_regrdwr_write()' and 'mwifiex_rdeeprom_write()'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Acked-by: default avatarBrian Norris <briannorris@chromium.org>
Signed-off-by: default avatarDmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230802160726.85545-3-dmantipov@yandex.ru
parent 9b1cd826

drivers/net/wireless/marvell/mwifiex/debugfs.c

+8 −2
Original line number Diff line number Diff line
@@ -425,7 +425,10 @@ mwifiex_regrdwr_write(struct file *file, 
	if (IS_ERR(buf))

		return PTR_ERR(buf);



	sscanf(buf, "%u %x %x", &reg_type, &reg_offset, &reg_value);

	if (sscanf(buf, "%u %x %x", &reg_type, &reg_offset, &reg_value) != 3) {

		ret = -EINVAL;

		goto done;

	}



	if (reg_type == 0 || reg_offset == 0) {

		ret = -EINVAL;
@@ -691,7 +694,10 @@ mwifiex_rdeeprom_write(struct file *file, 
	if (IS_ERR(buf))

		return PTR_ERR(buf);



	sscanf(buf, "%d %d", &offset, &bytes);

	if (sscanf(buf, "%d %d", &offset, &bytes) != 2) {

		ret = -EINVAL;

		goto done;

	}



	if (offset == -1 || bytes == -1) {

		ret = -EINVAL;