rndis_wlan: add range check in del_key()

Wifi drivers can have up to 6 keys but the rndis_wlan only has 4 so
it needs to have its own checks to make sure we don't go out of
bounds.  The add_key() function already checks but I added some
checks to del_key() and set_default_key().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 8 insertions, 1 deletions

diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 0c13840a7de5..83f3e5282aea 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -414,6 +414,7 @@ struct ndis_80211_pmkid {
 #define RNDIS_WLAN_ALG_TKIP     (1<<1)
 #define RNDIS_WLAN_ALG_CCMP     (1<<2)
 
+#define RNDIS_WLAN_NUM_KEYS             4
 #define RNDIS_WLAN_KEY_MGMT_NONE        0
 #define RNDIS_WLAN_KEY_MGMT_802_1X      (1<<0)
 #define RNDIS_WLAN_KEY_MGMT_PSK         (1<<1)
@@ -516,7 +517,7 @@ struct rndis_wlan_private {
 
         /* encryption stuff */
         int  encr_tx_key_index;
-        struct rndis_wlan_encr_key encr_keys[4];
+        struct rndis_wlan_encr_key encr_keys[RNDIS_WLAN_NUM_KEYS];
         int  wpa_version;
 
         u8 command_buffer[COMMAND_BUFFER_SIZE];
@@ -1535,6 +1536,9 @@ static int remove_key(struct usbnet *usbdev, int index, const u8 *bssid)
         bool is_wpa;
         int ret;
 
+        if (index >= RNDIS_WLAN_NUM_KEYS)
+                return -ENOENT;
+
         if (priv->encr_keys[index].len == 0)
                 return 0;
 
@@ -2451,6 +2455,9 @@ static int rndis_set_default_key(struct wiphy *wiphy, struct net_device *netdev,
 
         netdev_dbg(usbdev->net, "%s(%i)\n", __func__, key_index);
 
+        if (key_index >= RNDIS_WLAN_NUM_KEYS)
+                return -ENOENT;
+
         priv->encr_tx_key_index = key_index;
 
         if (is_wpa_key(priv, key_index))