diff options
| author | David S. Miller <davem@davemloft.net> | 2018-03-30 19:00:11 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-03-30 19:00:11 +0200 |
| commit | 6f14f49ce5eb00f533133df06c663fbaea13cd50 (patch) | |
| tree | b12e3754be49caaeb0ca5ff945607c7d3a7093a0 | |
| parent | tc-testing: add connmark action tests (diff) | |
| parent | ieee802154: ca8210: fix uninitialised data read (diff) | |
| download | linux-6f14f49ce5eb00f533133df06c663fbaea13cd50.tar.xz linux-6f14f49ce5eb00f533133df06c663fbaea13cd50.zip | |
Merge branch 'ieee802154-for-davem-2018-03-29' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan-next
Stefan Schmidt says:
====================
pull-request: ieee802154-next 2018-03-29
An update from ieee802154 for *net-next*
Colin fixed a unused variable in the new mcr20a driver.
Harry fixed an unitialised data read in the debugfs interface of the
ca8210 driver.
If there are any issues or you think these are to late for -rc1 (both can also
go into -rc2 as they are simple fixes) let me know.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ieee802154/ca8210.c | 14 | ||||
| -rw-r--r-- | drivers/net/ieee802154/mcr20a.c | 2 |
2 files changed, 11 insertions, 5 deletions
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c index 377af43b81b3..58299fb666ed 100644 --- a/drivers/net/ieee802154/ca8210.c +++ b/drivers/net/ieee802154/ca8210.c @@ -2493,13 +2493,14 @@ static ssize_t ca8210_test_int_user_write( struct ca8210_priv *priv = filp->private_data; u8 command[CA8210_SPI_BUF_SIZE]; - if (len > CA8210_SPI_BUF_SIZE) { + memset(command, SPI_IDLE, 6); + if (len > CA8210_SPI_BUF_SIZE || len < 2) { dev_warn( &priv->spi->dev, - "userspace requested erroneously long write (%zu)\n", + "userspace requested erroneous write length (%zu)\n", len ); - return -EMSGSIZE; + return -EBADE; } ret = copy_from_user(command, in_buf, len); @@ -2511,6 +2512,13 @@ static ssize_t ca8210_test_int_user_write( ); return -EIO; } + if (len != command[1] + 2) { + dev_err( + &priv->spi->dev, + "write len does not match packet length field\n" + ); + return -EBADE; + } ret = ca8210_test_check_upstream(command, priv->spi); if (ret == 0) { diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c index d9eb22a52551..55a22c761808 100644 --- a/drivers/net/ieee802154/mcr20a.c +++ b/drivers/net/ieee802154/mcr20a.c @@ -723,13 +723,11 @@ mcr20a_set_promiscuous_mode(struct ieee802154_hw *hw, const bool on) struct mcr20a_local *lp = hw->priv; int ret; u8 rx_frame_filter_reg = 0x0; - u8 val; dev_dbg(printdev(lp), "%s(%d)\n", __func__, on); if (on) { /* All frame types accepted*/ - val |= DAR_PHY_CTRL4_PROMISCUOUS; rx_frame_filter_reg &= ~(IAR_RX_FRAME_FLT_FRM_VER); rx_frame_filter_reg |= (IAR_RX_FRAME_FLT_ACK_FT | IAR_RX_FRAME_FLT_NS_FT); |