From: Ivo van Doorn Date: Fri, 23 Jan 2009 16:03:24 +0000 (+0100) Subject: rt2x00: Restrict firmware file lengths X-Git-Url: http://drtracing.org/?a=commitdiff_plain;h=9752a7bd7f36557f34283f5d75dfa32578437f08;p=deliverable%2Flinux.git rt2x00: Restrict firmware file lengths Add extra security to the drivers for firmware loading, check the firmware file length before uploading it to the hardware. Incorrect lengths might indicate a firmware upgrade (which is not yet supported by the driver) or otherwise incorrect firmware. Signed-off-by: Ivo van Doorn Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c index 3a7eccac8856..d81a8de9dc17 100644 --- a/drivers/net/wireless/rt2x00/rt61pci.c +++ b/drivers/net/wireless/rt2x00/rt61pci.c @@ -1199,6 +1199,11 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data, int i; u32 reg; + if (len != 8192) { + ERROR(rt2x00dev, "Invalid firmware file length (len=%zu)\n", len); + return -ENOENT; + } + /* * Wait for stable hardware. */ diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c index 60c43c11bc17..f854551be75d 100644 --- a/drivers/net/wireless/rt2x00/rt73usb.c +++ b/drivers/net/wireless/rt2x00/rt73usb.c @@ -1085,6 +1085,11 @@ static int rt73usb_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data, int status; u32 reg; + if (len != 2048) { + ERROR(rt2x00dev, "Invalid firmware file length (len=%zu)\n", len); + return -ENOENT; + } + /* * Wait for stable hardware. */