summaryrefslogtreecommitdiff
path: root/drivers/net/ieee802154
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/net/ieee802154')
-rw-r--r--drivers/net/ieee802154/ca8210.c14
-rw-r--r--drivers/net/ieee802154/mcr20a.c2
2 files changed, 11 insertions, 5 deletions
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 377af43b81b3..58299fb666ed 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -2493,13 +2493,14 @@ static ssize_t ca8210_test_int_user_write(
struct ca8210_priv *priv = filp->private_data;
u8 command[CA8210_SPI_BUF_SIZE];
- if (len > CA8210_SPI_BUF_SIZE) {
+ memset(command, SPI_IDLE, 6);
+ if (len > CA8210_SPI_BUF_SIZE || len < 2) {
dev_warn(
&priv->spi->dev,
- "userspace requested erroneously long write (%zu)\n",
+ "userspace requested erroneous write length (%zu)\n",
len
);
- return -EMSGSIZE;
+ return -EBADE;
}
ret = copy_from_user(command, in_buf, len);
@@ -2511,6 +2512,13 @@ static ssize_t ca8210_test_int_user_write(
);
return -EIO;
}
+ if (len != command[1] + 2) {
+ dev_err(
+ &priv->spi->dev,
+ "write len does not match packet length field\n"
+ );
+ return -EBADE;
+ }
ret = ca8210_test_check_upstream(command, priv->spi);
if (ret == 0) {
diff --git a/drivers/net/ieee802154/mcr20a.c b/drivers/net/ieee802154/mcr20a.c
index d9eb22a52551..55a22c761808 100644
--- a/drivers/net/ieee802154/mcr20a.c
+++ b/drivers/net/ieee802154/mcr20a.c
@@ -723,13 +723,11 @@ mcr20a_set_promiscuous_mode(struct ieee802154_hw *hw, const bool on)
struct mcr20a_local *lp = hw->priv;
int ret;
u8 rx_frame_filter_reg = 0x0;
- u8 val;
dev_dbg(printdev(lp), "%s(%d)\n", __func__, on);
if (on) {
/* All frame types accepted*/
- val |= DAR_PHY_CTRL4_PROMISCUOUS;
rx_frame_filter_reg &= ~(IAR_RX_FRAME_FLT_FRM_VER);
rx_frame_filter_reg |= (IAR_RX_FRAME_FLT_ACK_FT |
IAR_RX_FRAME_FLT_NS_FT);