Commit ec3cbb9c authored by Dan Carpenter's avatar Dan Carpenter Committed by John W. Linville
Browse files

rndis_wlan: add range check in del_key() 



Wifi drivers can have up to 6 keys but the rndis_wlan only has 4 so
it needs to have its own checks to make sure we don't go out of
bounds.  The add_key() function already checks but I added some
checks to del_key() and set_default_key().

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarJussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 48ef5c42

drivers/net/wireless/rndis_wlan.c

+8 −1
Original line number Diff line number Diff line
@@ -414,6 +414,7 @@ struct ndis_80211_pmkid { 
#define RNDIS_WLAN_ALG_TKIP	(1<<1)

#define RNDIS_WLAN_ALG_CCMP	(1<<2)



#define RNDIS_WLAN_NUM_KEYS		4

#define RNDIS_WLAN_KEY_MGMT_NONE	0

#define RNDIS_WLAN_KEY_MGMT_802_1X	(1<<0)

#define RNDIS_WLAN_KEY_MGMT_PSK		(1<<1)
@@ -516,7 +517,7 @@ struct rndis_wlan_private { 


	/* encryption stuff */

	int  encr_tx_key_index;

	struct rndis_wlan_encr_key encr_keys[4];

	struct rndis_wlan_encr_key encr_keys[RNDIS_WLAN_NUM_KEYS];

	int  wpa_version;



	u8 command_buffer[COMMAND_BUFFER_SIZE];
@@ -1535,6 +1536,9 @@ static int remove_key(struct usbnet *usbdev, int index, const u8 *bssid) 
	bool is_wpa;

	int ret;



	if (index >= RNDIS_WLAN_NUM_KEYS)

		return -ENOENT;



	if (priv->encr_keys[index].len == 0)

		return 0;
@@ -2451,6 +2455,9 @@ static int rndis_set_default_key(struct wiphy *wiphy, struct net_device *netdev, 


	netdev_dbg(usbdev->net, "%s(%i)\n", __func__, key_index);



	if (key_index >= RNDIS_WLAN_NUM_KEYS)

		return -ENOENT;



	priv->encr_tx_key_index = key_index;



	if (is_wpa_key(priv, key_index))