• Tim Gardner's avatar
    rtlwifi: rtl8192se firmware load can overflow target buffer · 3fccdcf5
    Tim Gardner authored
    Define RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE which represents the
    maximimum possible firmware file size. Use it in the definition
    of the buffer which receives the firmware file data.
    
    Set RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE closer to the actual size of
    the firmware file, e.g., 90000 (down from hard coded 164000). The current
    size of rtlwifi/rtl8192sefw.bin is 88856.
    
    Set max_fw_size to RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE for the size limit
    check. Fix the error case where max_fw_size is not cleared if the size
    limit check fails.
    
    Cc: Chaoming Li <chaoming_li@realsil.com.cn>
    Cc: linux-wireless@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: default avatarTim Gardner <tim.gardner@canonical.com>
    Signed-off-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
    3fccdcf5
sw.c 14.4 KB