wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()

[ Upstream commit 7a4836560a6198d245d5732e26f94898b12eb760 ]

The simple_write_to_buffer() function will succeed if even a single
byte is initialized.  However, we need to initialize the whole buffer
to prevent information leaks.  Just use memdup_user().

Fixes: ff974e408334 ("wil6210: debugfs interface to send raw WMI command")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/Ysg14NdKAZF/hcNG@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 4c944e595978b13bd1bc4aaf252a6a2664a344fa..c6f8254cb21d69c955e6238e42fea0af2034bd74 100644 (file)
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -1012,18 +1012,12 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf,
        u16 cmdid;
        int rc, rc1;
 
-       if (cmdlen < 0)
+       if (cmdlen < 0 || *ppos != 0)
                return -EINVAL;
 
-       wmi = kmalloc(len, GFP_KERNEL);
-       if (!wmi)
-               return -ENOMEM;
-
-       rc = simple_write_to_buffer(wmi, len, ppos, buf, len);
-       if (rc < 0) {
-               kfree(wmi);
-               return rc;
-       }
+       wmi = memdup_user(buf, len);
+       if (IS_ERR(wmi))
+               return PTR_ERR(wmi);
 
        cmd = (cmdlen > 0) ? &wmi[1] : NULL;
        cmdid = le16_to_cpu(wmi->command_id);