[3.11.y.z extended stable] Patch "iwlwifi: mvm: check sta_id/drain values in debugfs" has been added to staging queue

[Luis Henriques]

This is a note to let you know that I have just added a patch titled

    iwlwifi: mvm: check sta_id/drain values in debugfs

to the linux-3.11.y-queue branch of the 3.11.y.z extended stable tree 
which can be found at:

 http://kernel.ubuntu.com/git?p=ubuntu/linux.git;a=shortlog;h=refs/heads/linux-3.11.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.11.y.z tree, see
https://wiki.ubuntu.com/Kernel/Dev/ExtendedStable

Thanks.
-Luis

------

>From 97d6b5b9e50b1a453615b3aca3c9a034dd1f6db6 Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg at intel.com>
Date: Fri, 25 Oct 2013 13:06:06 +0200
Subject: iwlwifi: mvm: check sta_id/drain values in debugfs

commit 60765a47a433d54e4744c285ad127f182dcd80aa upstream.

The station ID must be valid, if it's out of range then
the array access may crash. Validate the station ID to
the array length, and also validate the drain value even
if that doesn't matter all that much.

Fixes: 8ca151b568b6 ("iwlwifi: add the MVM driver")
Signed-off-by: Johannes Berg <johannes.berg at intel.com>
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach at intel.com>
Signed-off-by: Luis Henriques <luis.henriques at canonical.com>
---
 drivers/net/wireless/iwlwifi/mvm/debugfs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index c24a744..b52e8b6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -119,6 +119,10 @@ static ssize_t iwl_dbgfs_sta_drain_write(struct file *file,

 	if (sscanf(buf, "%d %d", &sta_id, &drain) != 2)
 		return -EINVAL;
+	if (sta_id < 0 || sta_id >= IWL_MVM_STATION_COUNT)
+		return -EINVAL;
+	if (drain < 0 || drain > 1)
+		return -EINVAL;

 	mutex_lock(&mvm->mutex);

--
1.8.3.2