diff options
| author | cm <cesar.maximo@gmail.com> | 2016-09-18 20:59:40 +0100 |
|---|---|---|
| committer | Moyster <oysterized@gmail.com> | 2016-11-11 02:37:11 +0100 |
| commit | a9bc0db8775a4e03082159808f8682061ba5b999 (patch) | |
| tree | 5a9290ec2a27807c9802258b6c5957d2fa5e02bd /drivers/misc/mediatek/connectivity | |
| parent | cd7e6f9834bef283bebd61cd51fec2348a1dac2b (diff) | |
Fix "Security Vulnerability - kernel info leak of wifi driver"
Diffstat (limited to 'drivers/misc/mediatek/connectivity')
| -rwxr-xr-x | drivers/misc/mediatek/connectivity/conn_soc/drv_wlan/mt_wifi/wlan/os/linux/gl_wext_priv.c | 21 |
1 files changed, 14 insertions, 7 deletions
diff --git a/drivers/misc/mediatek/connectivity/conn_soc/drv_wlan/mt_wifi/wlan/os/linux/gl_wext_priv.c b/drivers/misc/mediatek/connectivity/conn_soc/drv_wlan/mt_wifi/wlan/os/linux/gl_wext_priv.c index 5fb145f24..1a98dc81f 100755 --- a/drivers/misc/mediatek/connectivity/conn_soc/drv_wlan/mt_wifi/wlan/os/linux/gl_wext_priv.c +++ b/drivers/misc/mediatek/connectivity/conn_soc/drv_wlan/mt_wifi/wlan/os/linux/gl_wext_priv.c @@ -1601,14 +1601,21 @@ priv_get_int ( case PRIV_CMD_GET_DEBUG_CODE: { - wlanQueryDebugCode(prGlueInfo->prAdapter); + wlanQueryDebugCode(prGlueInfo->prAdapter); - kalMemSet(gucBufDbgCode, '.', sizeof(gucBufDbgCode)); - if (copy_to_user(prIwReqData->data.pointer, gucBufDbgCode, prIwReqData->data.length)) { - return -EFAULT; - } - else - return status; + kalMemSet(gucBufDbgCode, '.', sizeof(gucBufDbgCode)); + + u4BufLen = prIwReqData->data.length; + + if (prIwReqData->data.length > sizeof(gucBufDbgCode)) + u4BufLen = sizeof(gucBufDbgCode); + + if (copy_to_user(prIwReqData->data.pointer, gucBufDbgCode, u4BufLen)) { + return -EFAULT; + } + else { + return status; + } } default: |