diff options
author | Rafał Miłecki <rafal@milecki.pl> | 2018-08-16 10:48:54 +0200 |
---|---|---|
committer | Rafał Miłecki <rafal@milecki.pl> | 2018-08-16 13:15:05 +0200 |
commit | 57102f6c0633e08c96c868fde69c5a095c5d1102 (patch) | |
tree | 956fabf860189e82e30346ec9c4ba48288551a1e /package/kernel/mac80211/patches/328-v4.15-0001-brcmfmac-Avoid-possible-out-of-bounds-read.patch | |
parent | 6805e44004b7e310743a638ce826010744ad9ff6 (diff) | |
download | upstream-57102f6c0633e08c96c868fde69c5a095c5d1102.tar.gz upstream-57102f6c0633e08c96c868fde69c5a095c5d1102.tar.bz2 upstream-57102f6c0633e08c96c868fde69c5a095c5d1102.zip |
mac80211: brcmfmac: backport important changes from the 4.15
Two more patches that may be worth backporting in the future:
fdd0bd88ceae brcmfmac: add CLM download support
cc124d5cc8d8 brcmfmac: fix CLM load error for legacy chips when user helper is enabled
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Diffstat (limited to 'package/kernel/mac80211/patches/328-v4.15-0001-brcmfmac-Avoid-possible-out-of-bounds-read.patch')
-rw-r--r-- | package/kernel/mac80211/patches/328-v4.15-0001-brcmfmac-Avoid-possible-out-of-bounds-read.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/package/kernel/mac80211/patches/328-v4.15-0001-brcmfmac-Avoid-possible-out-of-bounds-read.patch b/package/kernel/mac80211/patches/328-v4.15-0001-brcmfmac-Avoid-possible-out-of-bounds-read.patch new file mode 100644 index 0000000000..f46c0abb61 --- /dev/null +++ b/package/kernel/mac80211/patches/328-v4.15-0001-brcmfmac-Avoid-possible-out-of-bounds-read.patch @@ -0,0 +1,39 @@ +From 73f2c8e933b1dcf432ac8c6965a6e67af630077f Mon Sep 17 00:00:00 2001 +From: Kevin Cernekee <cernekee@chromium.org> +Date: Sat, 16 Sep 2017 21:08:22 -0700 +Subject: [PATCH] brcmfmac: Avoid possible out-of-bounds read + +In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before +the length of rxframe is validated. This could lead to uninitialized +data being accessed (but not printed). Since we already have a +perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec, +and ch.chspec is not modified by decchspec(), avoid the extra +assignment and use ch.chspec in the debug print. + +Suggested-by: Mattias Nissler <mnissler@chromium.org> +Signed-off-by: Kevin Cernekee <cernekee@chromium.org> +Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com> +Signed-off-by: Kalle Valo <kvalo@codeaurora.org> +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +@@ -1853,7 +1853,6 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probere + struct afx_hdl *afx_hdl = &p2p->afx_hdl; + struct brcmf_cfg80211_vif *vif = ifp->vif; + struct brcmf_rx_mgmt_data *rxframe = (struct brcmf_rx_mgmt_data *)data; +- u16 chanspec = be16_to_cpu(rxframe->chanspec); + struct brcmu_chan ch; + u8 *mgmt_frame; + u32 mgmt_frame_len; +@@ -1906,7 +1905,7 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probere + cfg80211_rx_mgmt(&vif->wdev, freq, 0, mgmt_frame, mgmt_frame_len, 0); + + brcmf_dbg(INFO, "mgmt_frame_len (%d) , e->datalen (%d), chanspec (%04x), freq (%d)\n", +- mgmt_frame_len, e->datalen, chanspec, freq); ++ mgmt_frame_len, e->datalen, ch.chspec, freq); + + return 0; + } |