wlcore: check minimum buffer size in some cmd_send functions

Check for the minimum required buffer length in wlcore_cmd_send() and
wlcore_cmd_configure_failsafe.  This ensures that we will never try to
use a buffer that is smaller than the required header.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 05604ee312249cb9f493b270106be2d7ba38913b..5c6f3c84ad6fb4ff78e917c06287838d0b94b6ad 100644 (file)
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -64,6 +64,9 @@ static int __wlcore_cmd_send(struct wl1271 *wl, u16 id, void *buf,
                     id != CMD_STOP_FWLOGGER))
                return -EIO;
 
+       if (WARN_ON_ONCE(len < sizeof(*cmd)))
+               return -EIO;
+
        cmd = buf;
        cmd->id = cpu_to_le16(id);
        cmd->status = 0;
@@ -891,6 +894,9 @@ int wlcore_cmd_configure_failsafe(struct wl1271 *wl, u16 id, void *buf,
 
        wl1271_debug(DEBUG_CMD, "cmd configure (%d)", id);
 
+       if (WARN_ON_ONCE(len < sizeof(*acx)))
+               return -EIO;
+
        acx->id = cpu_to_le16(id);
 
        /* payload length, does not include any headers */