renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-24 13:13:57 +08:00
Code

staging: vt6656: iwctl_giwaplist/device_ioctl : use off stack buffers.

Browse Source 
Calls ioctl SIOCGIWAPLIST use off stack buffers.

clears up warning messages.
main_usb.c:2015:1: warning: the frame size of 1888 bytes is larger than 1024 bytes [-Wframe-larger-than=]
iwctl.c:683:1: warning: the frame size of 1280 bytes is larger than 1024 bytes [-Wframe-larger-than=]

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Malcolm Priestley 2012-11-13 21:04:36 +00:00 committed by Greg Kroah-Hartman
parent b87ea759a4
commit 848ce5112e
2 changed files with 67 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
drivers/staging/vt6656/iwctl.c
View File

@ -632,47 +632,56 @@ int iwctl_giwap(struct net_device *dev, struct iw_request_info *info,
* Wireless Handler: get ap list
*/
int iwctl_giwaplist(struct net_device *dev, struct iw_request_info *info,
struct iw_point *wrq, char *extra)
struct iw_point *wrq, u8 *extra)
{
struct sockaddr *sock;
struct iw_quality *qual;
PSDevice pDevice = netdev_priv(dev);
PSMgmtObject pMgmt = &pDevice->sMgmtObj;
PKnownBSS pBSS = &pMgmt->sBSSList[0];
int ii;
int jj;
int rc = 0;
struct sockaddr sock[IW_MAX_AP];
struct iw_quality qual[IW_MAX_AP];
PSDevice pDevice = netdev_priv(dev);
PSMgmtObject pMgmt = &(pDevice->sMgmtObj);
DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO " SIOCGIWAPLIST \n");
// Only super-user can see AP list
DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO " SIOCGIWAPLIST\n");
/* Only super-user can see AP list */
if (!capable(CAP_NET_ADMIN)) {
rc = -EPERM;
return rc;
if (pBSS == NULL)
return -ENODEV;
if (!capable(CAP_NET_ADMIN))
return -EPERM;
if (!wrq->pointer)
return -EINVAL;
sock = kzalloc(sizeof(struct sockaddr) * IW_MAX_AP, GFP_KERNEL);
qual = kzalloc(sizeof(struct iw_quality) * IW_MAX_AP, GFP_KERNEL);
if (sock == NULL || qual == NULL)
return -ENOMEM;
for (ii = 0, jj = 0; ii < MAX_BSS_NUM; ii++) {
if (!pBSS[ii].bActive)
continue;
if (jj >= IW_MAX_AP)
break;
memcpy(sock[jj].sa_data, pBSS[ii].abyBSSID, 6);
sock[jj].sa_family = ARPHRD_ETHER;
qual[jj].level = pBSS[ii].uRSSI;
qual[jj].qual = qual[jj].noise = 0;
qual[jj].updated = 2;
jj++;
}
if (wrq->pointer) {
PKnownBSS pBSS = &(pMgmt->sBSSList[0]);
wrq->flags = 1; /* Should be defined */
wrq->length = jj;
memcpy(extra, sock, sizeof(struct sockaddr) * jj);
memcpy(extra + sizeof(struct sockaddr) * jj, qual,
sizeof(struct iw_quality) * jj);
for (ii = 0, jj= 0; ii < MAX_BSS_NUM; ii++) {
pBSS = &(pMgmt->sBSSList[ii]);
if (!pBSS->bActive)
continue;
if (jj >= IW_MAX_AP)
break;
memcpy(sock[jj].sa_data, pBSS->abyBSSID, 6);
sock[jj].sa_family = ARPHRD_ETHER;
qual[jj].level = pBSS->uRSSI;
qual[jj].qual = qual[jj].noise = 0;
qual[jj].updated = 2;
jj++;
}
kfree(sock);
kfree(qual);
wrq->flags = 1; // Should be defined
wrq->length = jj;
memcpy(extra, sock, sizeof(struct sockaddr) * jj);
memcpy(extra + sizeof(struct sockaddr) * jj, qual, sizeof(struct iw_quality) * jj);
}
return rc;
return 0;
}
/*

44
drivers/staging/vt6656/main_usb.c
View File

@ -1555,12 +1555,12 @@ static struct net_device_stats *device_get_stats(struct net_device *dev) {
static int device_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) {
PSDevice pDevice = (PSDevice)netdev_priv(dev);
PSMgmtObject pMgmt = &(pDevice->sMgmtObj);
PSCmdRequest pReq;
//BOOL bCommit = FALSE;
PSDevice pDevice = (PSDevice)netdev_priv(dev);
PSMgmtObject pMgmt = &pDevice->sMgmtObj;
PSCmdRequest pReq;
u8 *buffer;
struct iwreq *wrq = (struct iwreq *) rq;
int rc =0;
int rc = 0;
if (pMgmt == NULL) {
rc = -EFAULT;
@ -1797,20 +1797,28 @@ static int device_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) {
break;
case SIOCGIWAPLIST:
{
char buffer[IW_MAX_AP * (sizeof(struct sockaddr) + sizeof(struct iw_quality))];
if (wrq->u.data.pointer) {
buffer = kzalloc((sizeof(struct sockaddr) +
sizeof(struct iw_quality)) * IW_MAX_AP,
GFP_KERNEL);
if (buffer == NULL) {
rc = -ENOMEM;
break;
}
if (wrq->u.data.pointer) {
rc = iwctl_giwaplist(dev, NULL, &(wrq->u.data), buffer);
if (rc == 0) {
if (copy_to_user(wrq->u.data.pointer,
buffer,
(wrq->u.data.length * (sizeof(struct sockaddr) + sizeof(struct iw_quality)))
))
rc = -EFAULT;
}
}
}
rc = iwctl_giwaplist(dev, NULL, &(wrq->u.data), buffer);
if (rc < 0) {
kfree(buffer);
break;
}
if (copy_to_user(wrq->u.data.pointer, buffer,
wrq->u.data.length * (sizeof(struct sockaddr)
+ sizeof(struct iw_quality))))
rc = -EFAULT;
kfree(buffer);
}
break;