From: Solomon Peachy <pizza@shaftnet.org>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: linux-wireless@vger.kernel.org
Subject: Re: cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets
Date: Tue, 4 Jun 2013 09:43:41 -0400 [thread overview]
Message-ID: <20130604134340.GA3813@shaftnet.org> (raw)
In-Reply-To: <20130604130955.GA13788@debian>
[-- Attachment #1: Type: text/plain, Size: 1518 bytes --]
On Tue, Jun 04, 2013 at 06:09:55AM -0700, Dan Carpenter wrote:
> The patch a910e4a94f69: "cw1200: add driver for the ST-E CW1100 &
> CW1200 WLAN chipsets" from May 24, 2013, has poor input validation
> so the user could write to arbitrary memory.
> Also I think this API looks like things which should be done with
> normal ioctls. This driver only lets you load the firmware using a
> very ugly custom debugfs interface?
No, this is a debugging interface designed to interact with the
vendor-supplied testing tool and the passthrough API it requires. The
vendor tool controls the device init sequence, including special
engineering firmware.
Support for the ETF hooks is optional, and even if compiled in has to be
explicitly enabled with a module parameter.
> drivers/net/wireless/cw1200/debug.c
> 454
> 455 if (!count)
> 456 goto done;
> 457
> 458 if (copy_from_user(etf->buf + etf->written, user_buf + written,
> 459 count)) {
>
> "count" isn't capped so we could overwrite etf->written on the first
> write and then write to arbitrary memery on the second write.
Okay, that's easy enough to fix. Thanks for pointing this out.
I'll try to robustify this rather ugly interface as much as possible.
- Solomon
--
Solomon Peachy pizza at shaftnet dot org
Delray Beach, FL ^^ (email/xmpp) ^^
Quidquid latine dictum sit, altum viditur.
[-- Attachment #2: Type: application/pgp-signature, Size: 190 bytes --]
next prev parent reply other threads:[~2013-06-04 13:43 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-06-04 13:09 cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets Dan Carpenter
2013-06-04 13:43 ` Solomon Peachy [this message]
2013-06-05 8:06 ` Kalle Valo
2013-06-05 11:12 ` Solomon Peachy
2013-06-05 11:36 ` Kalle Valo
2013-06-05 19:11 ` Solomon Peachy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130604134340.GA3813@shaftnet.org \
--to=pizza@shaftnet.org \
--cc=dan.carpenter@oracle.com \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).