hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

brcmfmac: Add check for short event packets 

The length of the data in the received skb is currently passed into
brcmf_fweh_process_event() as packet_len, but this value is not checked.
event_packet should be followed by DATALEN bytes of additional event
data.  Ensure that the received packet actually contains at least
DATALEN bytes of additional data, to avoid copying uninitialized memory
into event->data.

Cc: <stable@vger.kernel.org> # v3.8
Suggested-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
This commit is contained in:
Kevin Cernekee 2017-09-16 21:08:24 -07:00 committed by Kalle Valo
parent b8b8b16352
commit dd2349121b
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
View File

@ -429,7 +429,8 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr,
if (code != BRCMF_E_IF && !fweh->evt_handler[code])
return;
if (datalen > BRCMF_DCMD_MAXLEN)
if (datalen > BRCMF_DCMD_MAXLEN ||
datalen + sizeof(*event_packet) > packet_len)
return;
if (in_interrupt())