From 6f0ede54387e4a49fae8a94766e5ec06640bcb38 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= Date: Wed, 12 Sep 2018 08:40:03 +0200 Subject: mac80211: brcmfmac: backport CYW89342 support & fixes from 4.20 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Rafał Miłecki (cherry picked from commit b3d441c5f7c5247c1b0c3b6e9827d49a27093d50) --- ...344-0001-brcmfmac-fix-wrong-strnchr-usage.patch | 38 ++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 package/kernel/mac80211/patches/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch (limited to 'package/kernel/mac80211/patches/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch') diff --git a/package/kernel/mac80211/patches/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch b/package/kernel/mac80211/patches/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch new file mode 100644 index 0000000000..8267b37864 --- /dev/null +++ b/package/kernel/mac80211/patches/344-0001-brcmfmac-fix-wrong-strnchr-usage.patch @@ -0,0 +1,38 @@ +From cb18e2e9ec71d42409a51b83546686c609780dde Mon Sep 17 00:00:00 2001 +From: Rasmus Villemoes +Date: Wed, 22 Aug 2018 15:22:15 +0200 +Subject: [PATCH] brcmfmac: fix wrong strnchr usage + +strnchr takes arguments in the order of its name: string, max bytes to +read, character to search for. Here we're passing '\n' aka 10 as the +buffer size, and searching for sizeof(buf) aka BRCMF_DCMD_SMLEN aka +256 (aka '\0', since it's implicitly converted to char) within those 10 +bytes. + +Just interchanging the last two arguments would still leave a bug, +because if we've been successful once, there are not sizeof(buf) +characters left after the new value of p. + +Since clmver is immediately afterwards passed as a %s argument, I assume +that it is actually a properly nul-terminated string. For that case, we +have strreplace(). + +Signed-off-by: Rasmus Villemoes +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c +@@ -296,9 +296,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_i + /* Replace all newline/linefeed characters with space + * character + */ +- ptr = clmver; +- while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL) +- *ptr = ' '; ++ strreplace(clmver, '\n', ' '); + + brcmf_dbg(INFO, "CLM version = %s\n", clmver); + } -- cgit v1.2.3