Hello Solomon Peachy,
The patch a910e4a94f69: "cw1200: add driver for the ST-E CW1100 &
CW1200 WLAN chipsets" from May 24, 2013, has poor input validation
so the user could write to arbitrary memory.
Also I think this API looks like things which should be done with
normal ioctls. This driver only lets you load the firmware using a
very ugly custom debugfs interface?
drivers/net/wireless/cw1200/debug.c
454
455 if (!count)
456 goto done;
457
458 if (copy_from_user(etf->buf + etf->written, user_buf + written,
459 count)) {
"count" isn't capped so we could overwrite etf->written on the first
write and then write to arbitrary memery on the second write.
460 pr_err("copy_from_user (payload %zu) failed\n", count);
461 return -EFAULT;
462 }
regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
