diff options
| author | Varun Wadekar <vwadekar@nvidia.com> | 2012-01-16 15:32:21 +0530 |
|---|---|---|
| committer | Varun Wadekar <vwadekar@nvidia.com> | 2012-01-16 15:32:21 +0530 |
| commit | 7919e929aa227048738e14df6bcbad3ee4458443 (patch) | |
| tree | 0c38267369fa636d7435bf22af39e3783a24ef62 /drivers/net/wireless/wl12xx/boot.c | |
| parent | fcbd75c6b179b717b074d0cb7490e42ae728fb2d (diff) | |
| parent | 93dad393c796013cb6371be63d7af600c5e36c2c (diff) | |
Merge branch 'linux-3.1.y' into android-tegra-nv-3.1
Linux 3.1.9
Conflicts:
Makefile
Change-Id: I22227ab33ba7ddaba8e6fe049393c58a83d73648
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Diffstat (limited to 'drivers/net/wireless/wl12xx/boot.c')
| -rw-r--r-- | drivers/net/wireless/wl12xx/boot.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/drivers/net/wireless/wl12xx/boot.c b/drivers/net/wireless/wl12xx/boot.c index 5ebc64d89407..454e913bec67 100644 --- a/drivers/net/wireless/wl12xx/boot.c +++ b/drivers/net/wireless/wl12xx/boot.c @@ -358,6 +358,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl) nvs_ptr += 3; for (i = 0; i < burst_len; i++) { + if (nvs_ptr + 3 >= (u8 *) wl->nvs + nvs_len) + goto out_badnvs; + val = (nvs_ptr[0] | (nvs_ptr[1] << 8) | (nvs_ptr[2] << 16) | (nvs_ptr[3] << 24)); @@ -369,6 +372,9 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl) nvs_ptr += 4; dest_addr += 4; } + + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len) + goto out_badnvs; } /* @@ -380,6 +386,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl) */ nvs_ptr = (u8 *)wl->nvs + ALIGN(nvs_ptr - (u8 *)wl->nvs + 7, 4); + + if (nvs_ptr >= (u8 *) wl->nvs + nvs_len) + goto out_badnvs; + nvs_len -= nvs_ptr - (u8 *)wl->nvs; /* Now we must set the partition correctly */ @@ -395,6 +405,10 @@ static int wl1271_boot_upload_nvs(struct wl1271 *wl) kfree(nvs_aligned); return 0; + +out_badnvs: + wl1271_error("nvs data is malformed"); + return -EILSEQ; } static void wl1271_boot_enable_interrupts(struct wl1271 *wl) |