mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-02 23:27:06 +00:00
Code Issues Releases Wiki Activity

wifi: mwifiex: handle possible sscanf() errors

Browse source 
Return -EINVAL on possible 'sscanf()' errors in
'mwifiex_regrdwr_write()' and 'mwifiex_rdeeprom_write()'.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230802160726.85545-3-dmantipov@yandex.ru
This commit is contained in:
Dmitry Antipov 2023-08-02 19:07:17 +03:00 committed by Kalle Valo
parent 9b1cd8266f
commit 968d02c613
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/net/wireless/marvell/mwifiex/debugfs.c
View file

@ -425,7 +425,10 @@ mwifiex_regrdwr_write(struct file *file,
if (IS_ERR(buf))
return PTR_ERR(buf);
sscanf(buf, "%u %x %x", &reg_type, &reg_offset, &reg_value);
if (sscanf(buf, "%u %x %x", &reg_type, &reg_offset, &reg_value) != 3) {
ret = -EINVAL;
goto done;
}
if (reg_type == 0 || reg_offset == 0) {
ret = -EINVAL;
@ -691,7 +694,10 @@ mwifiex_rdeeprom_write(struct file *file,
if (IS_ERR(buf))
return PTR_ERR(buf);
sscanf(buf, "%d %d", &offset, &bytes);
if (sscanf(buf, "%d %d", &offset, &bytes) != 2) {
ret = -EINVAL;
goto done;
}
if (offset == -1 || bytes == -1) {
ret = -EINVAL;