Skip to content

Commit e05039b

Browse files
Weiguo Hurkhuangtao
Weiguo Hu
authored and
rkhuangtao
committed
net: wireless: rockchip_wlan: realtek wifi: p2p ioctl illegal parameter protect
References: CNVD-C-2020-309986, CNVD-C-2020-309987, CNVD-C-2020-309988 Signed-off-by: Weiguo Hu <hwg@rock-chips.com> Change-Id: I611e16f8155bac6431e0d786c29ef1425ff792d2
1 parent 7cd71ad commit e05039b

10 files changed

Lines changed: 140 additions & 0 deletions

File tree

‎drivers/net/wireless/rockchip_wlan/rtl8188eu/os_dep/linux/ioctl_linux.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4476,6 +4476,9 @@ static int rtw_p2p_set_intent(struct net_device *dev,
44764476
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
44774477
u8 intent = pwdinfo->intent;
44784478

4479+
if (wrqu->data.length >= 4096)
4480+
return -1;
4481+
44794482
extra[wrqu->data.length] = 0x00;
44804483

44814484
intent = rtw_atoi(extra);
@@ -4501,6 +4504,9 @@ static int rtw_p2p_set_listen_ch(struct net_device *dev,
45014504
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
45024505
u8 listen_ch = pwdinfo->listen_channel; /* Listen channel number */
45034506

4507+
if (wrqu->data.length >= 4096)
4508+
return -1;
4509+
45044510
extra[wrqu->data.length] = 0x00;
45054511
listen_ch = rtw_atoi(extra);
45064512

@@ -4528,6 +4534,9 @@ static int rtw_p2p_set_op_ch(struct net_device *dev,
45284534
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
45294535
u8 op_ch = pwdinfo->operating_channel; /* Operating channel number */
45304536

4537+
if (wrqu->data.length >= 4096)
4538+
return -1;
4539+
45314540
extra[wrqu->data.length] = 0x00;
45324541

45334542
op_ch = (u8) rtw_atoi(extra);
@@ -13221,6 +13230,11 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1322113230
extra = buffer;
1322213231

1322313232
handler = priv[priv_args[k].cmd - SIOCIWFIRSTPRIV];
13233+
if (handler == NULL) {
13234+
err = -EINVAL;
13235+
goto exit;
13236+
}
13237+
1322413238
err = handler(dev, NULL, &wdata, extra);
1322513239

1322613240
/* If we have to get some data */

‎drivers/net/wireless/rockchip_wlan/rtl8188fu/os_dep/linux/ioctl_linux.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4916,6 +4916,9 @@ static int rtw_p2p_set_intent(struct net_device *dev,
49164916
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
49174917
u8 intent = pwdinfo->intent;
49184918

4919+
if (wrqu->data.length >= 4096)
4920+
return -1;
4921+
49194922
extra[ wrqu->data.length ] = 0x00;
49204923

49214924
intent = rtw_atoi( extra );
@@ -4945,6 +4948,9 @@ static int rtw_p2p_set_listen_ch(struct net_device *dev,
49454948
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
49464949
u8 listen_ch = pwdinfo->listen_channel; // Listen channel number
49474950

4951+
if (wrqu->data.length >= 4096)
4952+
return -1;
4953+
49484954
extra[ wrqu->data.length ] = 0x00;
49494955
listen_ch = rtw_atoi( extra );
49504956

@@ -4976,6 +4982,9 @@ static int rtw_p2p_set_op_ch(struct net_device *dev,
49764982
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
49774983
u8 op_ch = pwdinfo->operating_channel; // Operating channel number
49784984

4985+
if (wrqu->data.length >= 4096)
4986+
return -1;
4987+
49794988
extra[ wrqu->data.length ] = 0x00;
49804989

49814990
op_ch = ( u8 ) rtw_atoi( extra );
@@ -13842,6 +13851,11 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1384213851
extra = buffer;
1384313852

1384413853
handler = priv[priv_args[k].cmd - SIOCIWFIRSTPRIV];
13854+
if (handler == NULL) {
13855+
err = -EINVAL;
13856+
goto exit;
13857+
}
13858+
1384513859
err = handler(dev, NULL, &wdata, extra);
1384613860

1384713861
/* If we have to get some data */

‎drivers/net/wireless/rockchip_wlan/rtl8189es/os_dep/linux/ioctl_linux.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4963,6 +4963,9 @@ static int rtw_p2p_set_intent(struct net_device *dev,
49634963
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
49644964
u8 intent = pwdinfo->intent;
49654965

4966+
if (wrqu->data.length >= 4096)
4967+
return -1;
4968+
49664969
extra[ wrqu->data.length ] = 0x00;
49674970

49684971
intent = rtw_atoi( extra );
@@ -4992,6 +4995,9 @@ static int rtw_p2p_set_listen_ch(struct net_device *dev,
49924995
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
49934996
u8 listen_ch = pwdinfo->listen_channel; // Listen channel number
49944997

4998+
if (wrqu->data.length >= 4096)
4999+
return -1;
5000+
49955001
extra[ wrqu->data.length ] = 0x00;
49965002
listen_ch = rtw_atoi( extra );
49975003

@@ -5023,6 +5029,9 @@ static int rtw_p2p_set_op_ch(struct net_device *dev,
50235029
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
50245030
u8 op_ch = pwdinfo->operating_channel; // Operating channel number
50255031

5032+
if (wrqu->data.length >= 4096)
5033+
return -1;
5034+
50265035
extra[ wrqu->data.length ] = 0x00;
50275036

50285037
op_ch = ( u8 ) rtw_atoi( extra );
@@ -13797,6 +13806,11 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1379713806
extra = buffer;
1379813807

1379913808
handler = priv[priv_args[k].cmd - SIOCIWFIRSTPRIV];
13809+
if (handler == NULL) {
13810+
err = -EINVAL;
13811+
goto exit;
13812+
}
13813+
1380013814
err = handler(dev, NULL, &wdata, extra);
1380113815

1380213816
/* If we have to get some data */

‎drivers/net/wireless/rockchip_wlan/rtl8189fs/os_dep/linux/ioctl_linux.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3967,6 +3967,9 @@ static int rtw_p2p_set_intent(struct net_device *dev,
39673967
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
39683968
u8 intent = pwdinfo->intent;
39693969

3970+
if (wrqu->data.length >= 4096)
3971+
return -1;
3972+
39703973
extra[wrqu->data.length] = 0x00;
39713974

39723975
intent = rtw_atoi(extra);
@@ -3992,6 +3995,9 @@ static int rtw_p2p_set_listen_ch(struct net_device *dev,
39923995
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
39933996
u8 listen_ch = pwdinfo->listen_channel; /* Listen channel number */
39943997

3998+
if (wrqu->data.length >= 4096)
3999+
return -1;
4000+
39954001
extra[wrqu->data.length] = 0x00;
39964002
listen_ch = rtw_atoi(extra);
39974003

@@ -4019,6 +4025,9 @@ static int rtw_p2p_set_op_ch(struct net_device *dev,
40194025
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
40204026
u8 op_ch = pwdinfo->operating_channel; /* Operating channel number */
40214027

4028+
if (wrqu->data.length >= 4096)
4029+
return -1;
4030+
40224031
extra[wrqu->data.length] = 0x00;
40234032

40244033
op_ch = (u8) rtw_atoi(extra);
@@ -12724,6 +12733,11 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1272412733
extra = buffer;
1272512734

1272612735
handler = priv[priv_args[k].cmd - SIOCIWFIRSTPRIV];
12736+
if (handler == NULL) {
12737+
err = -EINVAL;
12738+
goto exit;
12739+
}
12740+
1272712741
err = handler(dev, NULL, &wdata, extra);
1272812742

1272912743
/* If we have to get some data */

‎drivers/net/wireless/rockchip_wlan/rtl8723bs/os_dep/linux/ioctl_linux.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4114,6 +4114,9 @@ static int rtw_p2p_set_intent(struct net_device *dev,
41144114
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
41154115
u8 intent = pwdinfo->intent;
41164116

4117+
if (wrqu->data.length >= 4096)
4118+
return -1;
4119+
41174120
extra[wrqu->data.length] = 0x00;
41184121

41194122
intent = rtw_atoi(extra);
@@ -4139,6 +4142,9 @@ static int rtw_p2p_set_listen_ch(struct net_device *dev,
41394142
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
41404143
u8 listen_ch = pwdinfo->listen_channel; /* Listen channel number */
41414144

4145+
if (wrqu->data.length >= 4096)
4146+
return -1;
4147+
41424148
extra[wrqu->data.length] = 0x00;
41434149
listen_ch = rtw_atoi(extra);
41444150

@@ -4166,6 +4172,9 @@ static int rtw_p2p_set_op_ch(struct net_device *dev,
41664172
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
41674173
u8 op_ch = pwdinfo->operating_channel; /* Operating channel number */
41684174

4175+
if (wrqu->data.length >= 4096)
4176+
return -1;
4177+
41694178
extra[wrqu->data.length] = 0x00;
41704179

41714180
op_ch = (u8) rtw_atoi(extra);
@@ -12918,6 +12927,11 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1291812927
extra = buffer;
1291912928

1292012929
handler = priv[priv_args[k].cmd - SIOCIWFIRSTPRIV];
12930+
if (handler == NULL) {
12931+
err = -EINVAL;
12932+
goto exit;
12933+
}
12934+
1292112935
err = handler(dev, NULL, &wdata, extra);
1292212936

1292312937
/* If we have to get some data */

‎drivers/net/wireless/rockchip_wlan/rtl8723bu/os_dep/linux/ioctl_linux.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4916,6 +4916,9 @@ static int rtw_p2p_set_intent(struct net_device *dev,
49164916
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
49174917
u8 intent = pwdinfo->intent;
49184918

4919+
if (wrqu->data.length >= 4096)
4920+
return -1;
4921+
49194922
extra[ wrqu->data.length ] = 0x00;
49204923

49214924
intent = rtw_atoi( extra );
@@ -4945,6 +4948,9 @@ static int rtw_p2p_set_listen_ch(struct net_device *dev,
49454948
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
49464949
u8 listen_ch = pwdinfo->listen_channel; // Listen channel number
49474950

4951+
if (wrqu->data.length >= 4096)
4952+
return -1;
4953+
49484954
extra[ wrqu->data.length ] = 0x00;
49494955
listen_ch = rtw_atoi( extra );
49504956

@@ -4976,6 +4982,9 @@ static int rtw_p2p_set_op_ch(struct net_device *dev,
49764982
struct wifidirect_info *pwdinfo= &(padapter->wdinfo);
49774983
u8 op_ch = pwdinfo->operating_channel; // Operating channel number
49784984

4985+
if (wrqu->data.length >= 4096)
4986+
return -1;
4987+
49794988
extra[ wrqu->data.length ] = 0x00;
49804989

49814990
op_ch = ( u8 ) rtw_atoi( extra );
@@ -13723,6 +13732,11 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1372313732
extra = buffer;
1372413733

1372513734
handler = priv[priv_args[k].cmd - SIOCIWFIRSTPRIV];
13735+
if (handler == NULL) {
13736+
err = -EINVAL;
13737+
goto exit;
13738+
}
13739+
1372613740
err = handler(dev, NULL, &wdata, extra);
1372713741

1372813742
/* If we have to get some data */

‎drivers/net/wireless/rockchip_wlan/rtl8723cs/os_dep/linux/ioctl_linux.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4476,6 +4476,9 @@ static int rtw_p2p_set_intent(struct net_device *dev,
44764476
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
44774477
u8 intent = pwdinfo->intent;
44784478

4479+
if (wrqu->data.length >= 4096)
4480+
return -1;
4481+
44794482
extra[wrqu->data.length] = 0x00;
44804483

44814484
intent = rtw_atoi(extra);
@@ -4501,6 +4504,9 @@ static int rtw_p2p_set_listen_ch(struct net_device *dev,
45014504
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
45024505
u8 listen_ch = pwdinfo->listen_channel; /* Listen channel number */
45034506

4507+
if (wrqu->data.length >= 4096)
4508+
return -1;
4509+
45044510
extra[wrqu->data.length] = 0x00;
45054511
listen_ch = rtw_atoi(extra);
45064512

@@ -4528,6 +4534,9 @@ static int rtw_p2p_set_op_ch(struct net_device *dev,
45284534
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
45294535
u8 op_ch = pwdinfo->operating_channel; /* Operating channel number */
45304536

4537+
if (wrqu->data.length >= 4096)
4538+
return -1;
4539+
45314540
extra[wrqu->data.length] = 0x00;
45324541

45334542
op_ch = (u8) rtw_atoi(extra);
@@ -13203,6 +13212,11 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1320313212
extra = buffer;
1320413213

1320513214
handler = priv[priv_args[k].cmd - SIOCIWFIRSTPRIV];
13215+
if (handler == NULL) {
13216+
err = -EINVAL;
13217+
goto exit;
13218+
}
13219+
1320613220
err = handler(dev, NULL, &wdata, extra);
1320713221

1320813222
/* If we have to get some data */

‎drivers/net/wireless/rockchip_wlan/rtl8723ds/os_dep/linux/ioctl_linux.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3973,6 +3973,9 @@ static int rtw_p2p_set_intent(struct net_device *dev,
39733973
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
39743974
u8 intent = pwdinfo->intent;
39753975

3976+
if (wrqu->data.length >= 4096)
3977+
return -1;
3978+
39763979
extra[wrqu->data.length] = 0x00;
39773980

39783981
intent = rtw_atoi(extra);
@@ -3998,6 +4001,9 @@ static int rtw_p2p_set_listen_ch(struct net_device *dev,
39984001
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
39994002
u8 listen_ch = pwdinfo->listen_channel; /* Listen channel number */
40004003

4004+
if (wrqu->data.length >= 4096)
4005+
return -1;
4006+
40014007
extra[wrqu->data.length] = 0x00;
40024008
listen_ch = rtw_atoi(extra);
40034009

@@ -4025,6 +4031,9 @@ static int rtw_p2p_set_op_ch(struct net_device *dev,
40254031
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
40264032
u8 op_ch = pwdinfo->operating_channel; /* Operating channel number */
40274033

4034+
if (wrqu->data.length >= 4096)
4035+
return -1;
4036+
40284037
extra[wrqu->data.length] = 0x00;
40294038

40304039
op_ch = (u8) rtw_atoi(extra);
@@ -12751,6 +12760,11 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1275112760
extra = buffer;
1275212761

1275312762
handler = priv[priv_args[k].cmd - SIOCIWFIRSTPRIV];
12763+
if (handler == NULL) {
12764+
err = -EINVAL;
12765+
goto exit;
12766+
}
12767+
1275412768
err = handler(dev, NULL, &wdata, extra);
1275512769

1275612770
/* If we have to get some data */

‎drivers/net/wireless/rockchip_wlan/rtl8821cs/os_dep/linux/ioctl_linux.c‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3967,6 +3967,9 @@ static int rtw_p2p_set_intent(struct net_device *dev,
39673967
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
39683968
u8 intent = pwdinfo->intent;
39693969

3970+
if (wrqu->data.length >= 4096)
3971+
return -1;
3972+
39703973
extra[wrqu->data.length] = 0x00;
39713974

39723975
intent = rtw_atoi(extra);
@@ -3992,6 +3995,9 @@ static int rtw_p2p_set_listen_ch(struct net_device *dev,
39923995
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
39933996
u8 listen_ch = pwdinfo->listen_channel; /* Listen channel number */
39943997

3998+
if (wrqu->data.length >= 4096)
3999+
return -1;
4000+
39954001
extra[wrqu->data.length] = 0x00;
39964002
listen_ch = rtw_atoi(extra);
39974003

@@ -4019,6 +4025,9 @@ static int rtw_p2p_set_op_ch(struct net_device *dev,
40194025
struct wifidirect_info *pwdinfo = &(padapter->wdinfo);
40204026
u8 op_ch = pwdinfo->operating_channel; /* Operating channel number */
40214027

4028+
if (wrqu->data.length >= 4096)
4029+
return -1;
4030+
40224031
extra[wrqu->data.length] = 0x00;
40234032

40244033
op_ch = (u8) rtw_atoi(extra);
@@ -12739,6 +12748,11 @@ static int _rtw_ioctl_wext_private(struct net_device *dev, union iwreq_data *wrq
1273912748
extra = buffer;
1274012749

1274112750
handler = priv[priv_args[k].cmd - SIOCIWFIRSTPRIV];
12751+
if (handler == NULL) {
12752+
err = -EINVAL;
12753+
goto exit;
12754+
}
12755+
1274212756
err = handler(dev, NULL, &wdata, extra);
1274312757

1274412758
/* If we have to get some data */

0 commit comments

Comments
 (0)