diff options
author | Rafał Miłecki <rafal@milecki.pl> | 2019-07-22 10:45:38 +0200 |
---|---|---|
committer | Rafał Miłecki <rafal@milecki.pl> | 2019-07-22 14:15:17 +0200 |
commit | a63907b3bbb07724d6526b20ae18ad90f351e954 (patch) | |
tree | 8fc98251910be8d12cfbbd387c35ce307cff7acc /package/kernel/mac80211/patches/319-v4.12-0007-brcmfmac-add-length-checks-in-scheduled-scan-result-.patch | |
parent | 1592815b2c852da83a8dcc62ffae967b6d7ea9d9 (diff) | |
download | upstream-a63907b3bbb07724d6526b20ae18ad90f351e954.tar.gz upstream-a63907b3bbb07724d6526b20ae18ad90f351e954.tar.bz2 upstream-a63907b3bbb07724d6526b20ae18ad90f351e954.zip |
mac80211: brcmfmac: rename v4.12 patches to allow more backports
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Diffstat (limited to 'package/kernel/mac80211/patches/319-v4.12-0007-brcmfmac-add-length-checks-in-scheduled-scan-result-.patch')
-rw-r--r-- | package/kernel/mac80211/patches/319-v4.12-0007-brcmfmac-add-length-checks-in-scheduled-scan-result-.patch | 61 |
1 files changed, 0 insertions, 61 deletions
diff --git a/package/kernel/mac80211/patches/319-v4.12-0007-brcmfmac-add-length-checks-in-scheduled-scan-result-.patch b/package/kernel/mac80211/patches/319-v4.12-0007-brcmfmac-add-length-checks-in-scheduled-scan-result-.patch deleted file mode 100644 index 2187de01c9..0000000000 --- a/package/kernel/mac80211/patches/319-v4.12-0007-brcmfmac-add-length-checks-in-scheduled-scan-result-.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 4835f37e3bafc138f8bfa3cbed2920dd56fed283 Mon Sep 17 00:00:00 2001 -From: Arend Van Spriel <arend.vanspriel@broadcom.com> -Date: Thu, 6 Apr 2017 13:14:40 +0100 -Subject: [PATCH] brcmfmac: add length checks in scheduled scan result handler - -Assure the event data buffer is long enough to hold the array -of netinfo items and that SSID length does not exceed the maximum -of 32 characters as per 802.11 spec. - -Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com> -Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com> -Reviewed-by: Franky Lin <franky.lin@broadcom.com> -Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> -Signed-off-by: Kalle Valo <kvalo@codeaurora.org> ---- - drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++++++++++-- - 1 file changed, 11 insertions(+), 2 deletions(-) - ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c -@@ -3300,6 +3300,7 @@ brcmf_notify_sched_scan_results(struct b - struct brcmf_pno_scanresults_le *pfn_result; - u32 result_count; - u32 status; -+ u32 datalen; - - brcmf_dbg(SCAN, "Enter\n"); - -@@ -3326,6 +3327,14 @@ brcmf_notify_sched_scan_results(struct b - brcmf_err("FALSE PNO Event. (pfn_count == 0)\n"); - goto out_err; - } -+ -+ netinfo_start = brcmf_get_netinfo_array(pfn_result); -+ datalen = e->datalen - ((void *)netinfo_start - (void *)pfn_result); -+ if (datalen < result_count * sizeof(*netinfo)) { -+ brcmf_err("insufficient event data\n"); -+ goto out_err; -+ } -+ - request = brcmf_alloc_internal_escan_request(wiphy, - result_count); - if (!request) { -@@ -3333,8 +3342,6 @@ brcmf_notify_sched_scan_results(struct b - goto out_err; - } - -- netinfo_start = brcmf_get_netinfo_array(pfn_result); -- - for (i = 0; i < result_count; i++) { - netinfo = &netinfo_start[i]; - if (!netinfo) { -@@ -3344,6 +3351,8 @@ brcmf_notify_sched_scan_results(struct b - goto out_err; - } - -+ if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN) -+ netinfo->SSID_len = IEEE80211_MAX_SSID_LEN; - brcmf_dbg(SCAN, "SSID:%.32s Channel:%d\n", - netinfo->SSID, netinfo->channel); - err = brcmf_internal_escan_add_info(request, |