rt2x00: Restrict firmware file lengths
authorIvo van Doorn <ivdoorn@gmail.com>
Fri, 23 Jan 2009 16:03:24 +0000 (17:03 +0100)
committerJohn W. Linville <linville@tuxdriver.com>
Thu, 29 Jan 2009 21:01:26 +0000 (16:01 -0500)
Add extra security to the drivers for firmware loading,
check the firmware file length before uploading it to
the hardware. Incorrect lengths might indicate a firmware
upgrade (which is not yet supported by the driver) or
otherwise incorrect firmware.

Signed-off-by: Ivo van Doorn <IvDoorn@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/rt2x00/rt61pci.c
drivers/net/wireless/rt2x00/rt73usb.c

index 3a7eccac885612e0a28ba04630dd184e2ca58b17..d81a8de9dc176fb11e674c70a9c688cb91bce07b 100644 (file)
@@ -1199,6 +1199,11 @@ static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data,
        int i;
        u32 reg;
 
+       if (len != 8192) {
+               ERROR(rt2x00dev, "Invalid firmware file length (len=%zu)\n", len);
+               return -ENOENT;
+       }
+
        /*
         * Wait for stable hardware.
         */
index 60c43c11bc17075cac1eece2793ad75dec531539..f854551be75d2d5b329fa67158bb42b0ff7397f5 100644 (file)
@@ -1085,6 +1085,11 @@ static int rt73usb_load_firmware(struct rt2x00_dev *rt2x00dev, const void *data,
        int status;
        u32 reg;
 
+       if (len != 2048) {
+               ERROR(rt2x00dev, "Invalid firmware file length (len=%zu)\n", len);
+               return -ENOENT;
+       }
+
        /*
         * Wait for stable hardware.
         */