rsi: check length before USB read/write register (59f73e2a) · Commits · 戴 / test

These checks are required. Otherwise we may end up getting memory corruption if invalid length is passed. Fixes: ("rsi: Add new host interface operations") Signed-off-by:

Amitkumar Karwar <amit.karwar@redpinesignals.com> Signed-off-by:

Kalle Valo <kvalo@codeaurora.org>

drivers/net/wireless/rsi/rsi_91x_usb.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -166,6 +166,9 @@ static int rsi_usb_reg_read(struct usb_device *usbdev,
		if (!buf)
		return status;

		if (len > RSI_USB_CTRL_BUF_SIZE)
		return -EINVAL;

		status = usb_control_msg(usbdev,
		usb_rcvctrlpipe(usbdev, 0),
		USB_VENDOR_REGISTER_READ,
		@@ -208,6 +211,9 @@ static int rsi_usb_reg_write(struct usb_device *usbdev,
		if (!usb_reg_buf)
		return status;

		if (len > RSI_USB_CTRL_BUF_SIZE)
		return -EINVAL;

		usb_reg_buf[0] = (value & 0x00ff);
		usb_reg_buf[1] = (value & 0xff00) >> 8;
		usb_reg_buf[2] = 0x0;

Admin message