aboutsummaryrefslogtreecommitdiff
path: root/drivers/net/wireless/rt2x00
diff options
context:
space:
mode:
authorIvo van Doorn <ivdoorn@gmail.com>2009-01-23 17:03:24 +0100
committerJohn W. Linville <linville@tuxdriver.com>2009-01-29 16:01:26 -0500
commit9752a7bd7f36557f34283f5d75dfa32578437f08 (patch)
treee936bbb3fb126c85d2ed3afd1e473c657776c647 /drivers/net/wireless/rt2x00
parent6ba265e9cc764bc401cda284954cf2bdd4408c38 (diff)
rt2x00: Restrict firmware file lengths
Add extra security to the drivers for firmware loading, check the firmware file length before uploading it to the hardware. Incorrect lengths might indicate a firmware upgrade (which is not yet supported by the driver) or otherwise incorrect firmware. Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/rt2x00')
-rw-r--r--drivers/net/wireless/rt2x00/rt61pci.c5
-rw-r--r--drivers/net/wireless/rt2x00/rt73usb.c5
2 files changed, 10 insertions, 0 deletions
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 3a7eccac885..d81a8de9dc1 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1199,6 +1199,11 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data,
int i;
u32 reg;
+ if (len != 8192) {
+ ERROR(rt2x00dev, "Invalid firmware file length (len=%zu)\n", len);
+ return -ENOENT;
+ }
+
/*
* Wait for stable hardware.
*/
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 60c43c11bc1..f854551be75 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1085,6 +1085,11 @@ static int rt73usb_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data,
int status;
u32 reg;
+ if (len != 2048) {
+ ERROR(rt2x00dev, "Invalid firmware file length (len=%zu)\n", len);
+ return -ENOENT;
+ }
+
/*
* Wait for stable hardware.
*/