Phil Turnbull
3eb6b89a4e
wifi: wilc1000: validate number of channels
...
commit 0cdfa9e6f0915e3d243e2393bfa8a22e12d553b0 upstream.
There is no validation of 'e->no_of_channels' which can trigger an
out-of-bounds write in the following 'memset' call. Validate that the
number of channels does not extends beyond the size of the channel list
element.
Signed-off-by: Phil Turnbull <philipturnbull@github.com >
Tested-by: Ajay Kathat <ajay.kathat@microchip.com >
Acked-by: Ajay Kathat <ajay.kathat@microchip.com >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://lore.kernel.org/r/20221123153543.8568-5-philipturnbull@github.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2022-12-02 17:40:06 +01:00
Phil Turnbull
5a068535c0
wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute
...
commit f9b62f9843c7b0afdaecabbcebf1dbba18599408 upstream.
Validate that the IEEE80211_P2P_ATTR_CHANNEL_LIST attribute contains
enough space for a 'struct wilc_attr_oper_ch'. If the attribute is too
small then it can trigger an out-of-bounds write later in the function.
'struct wilc_attr_oper_ch' is variable sized so also check 'attr_len'
does not extend beyond the end of 'buf'.
Signed-off-by: Phil Turnbull <philipturnbull@github.com >
Tested-by: Ajay Kathat <ajay.kathat@microchip.com >
Acked-by: Ajay Kathat <ajay.kathat@microchip.com >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://lore.kernel.org/r/20221123153543.8568-4-philipturnbull@github.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2022-12-02 17:40:06 +01:00
Phil Turnbull
905f886eae
wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute
...
commit 051ae669e4505abbe05165bebf6be7922de11f41 upstream.
Validate that the IEEE80211_P2P_ATTR_OPER_CHANNEL attribute contains
enough space for a 'struct struct wilc_attr_oper_ch'. If the attribute is
too small then it triggers an out-of-bounds write later in the function.
Signed-off-by: Phil Turnbull <philipturnbull@github.com >
Tested-by: Ajay Kathat <ajay.kathat@microchip.com >
Acked-by: Ajay Kathat <ajay.kathat@microchip.com >
Signed-off-by: Kalle Valo <kvalo@kernel.org >
Link: https://lore.kernel.org/r/20221123153543.8568-3-philipturnbull@github.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2022-12-02 17:40:06 +01:00
Ajay Singh
310f581f54
wilc1000: fix possible memory leak in cfg_scan_result()
...
[ Upstream commit 3c719fed0f3a5e95b1d164609ecc81c4191ade70 ]
When the BSS reference holds a valid reference, it is not freed. The 'if'
condition is wrong. Instead of the 'if (bss)' check, the 'if (!bss)' check
is used.
The issue is solved by removing the unnecessary 'if' check because
cfg80211_put_bss() already performs the NULL validation.
Fixes: 6cd4fa5ab6ajay.kathat@microchip.com >
Signed-off-by: Kalle Valo <kvalo@codeaurora.org >
Link: https://lore.kernel.org/r/20210916164902.74629-3-ajay.kathat@microchip.com
Signed-off-by: Sasha Levin <sashal@kernel.org >
2021-11-18 14:04:03 +01:00
Ajay Singh
9bdcbdafc6
wilc1000: fix compiler warning for 'wowlan_support' unused variable
...
Avoid below reported warning found when 'CONFIG_PM' config is
undefined.
'warning: unused variable 'wowlan_support' [-Wunused-const-variable]'
Reported-by: kernel test robot <lkp@intel.com >
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com >
Signed-off-by: Kalle Valo <kvalo@codeaurora.org >
Link: https://lore.kernel.org/r/20200710051826.3267-4-ajay.kathat@microchip.com
2020-07-14 20:52:24 +03:00
Ajay Singh
5625f965d7
wilc1000: move wilc driver out of staging
...
WILC1000 is an IEEE 802.11 b/g/n IoT link controller module. The
WILC1000 connects to Microchip AVR/SMART MCUs, SMART MPUs, and other
processors with minimal resource requirements with a simple
SPI/SDIO-to-Wi-Fi interface.
WILC1000 driver has been part of staging for few years. With
contributions from the community, it has improved significantly. Full
driver review has helped in achieving the current state.
The details for those reviews are captured in 1 & 2.
[1]. https://lore.kernel.org/linux-wireless/1537957525-11467-1-git-send-email-ajay.kathat@microchip.com/
[2]. https://lore.kernel.org/linux-wireless/1562896697-8002-1-git-send-email-ajay.kathat@microchip.com/
Signed-off-by: Ajay Singh <ajay.kathat@microchip.com >
Signed-off-by: Kalle Valo <kvalo@codeaurora.org >
2020-06-26 08:46:46 +03:00
