re: cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Solomon Peachy,

The patch a910e4a94f69: "cw1200: add driver for the ST-E CW1100 &
CW1200 WLAN chipsets" from May 24, 2013, has poor input validation
so the user could write to arbitrary memory.

Also I think this API looks like things which should be done with
normal ioctls.  This driver only lets you load the firmware using a
very ugly custom debugfs interface?

drivers/net/wireless/cw1200/debug.c
   454  
   455          if (!count)
   456                  goto done;
   457  
   458          if (copy_from_user(etf->buf + etf->written, user_buf + written,
   459                             count)) {

"count" isn't capped so we could overwrite etf->written on the first
write and then write to arbitrary memery on the second write.

   460                  pr_err("copy_from_user (payload %zu) failed\n", count);
   461                  return -EFAULT;
   462          }

regards,
dan carpenter