summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKevin Cernekee <cernekee@chromium.org>2017-09-17 06:08:24 +0200
committerKalle Valo <kvalo@codeaurora.org>2017-10-02 15:51:21 +0200
commitdd2349121bb1b8ff688c3ca6a2a0bea9d8c142ca (patch)
treeba8b84deba9a4702f5ea71520dba1169f9ee099e
parentrtlwifi: rtl8821ae: Fix connection lost problem (diff)
downloadlinux-dd2349121bb1b8ff688c3ca6a2a0bea9d8c142ca.tar.xz
linux-dd2349121bb1b8ff688c3ca6a2a0bea9d8c142ca.zip
brcmfmac: Add check for short event packets
The length of the data in the received skb is currently passed into brcmf_fweh_process_event() as packet_len, but this value is not checked. event_packet should be followed by DATALEN bytes of additional event data. Ensure that the received packet actually contains at least DATALEN bytes of additional data, to avoid copying uninitialized memory into event->data. Cc: <stable@vger.kernel.org> # v3.8 Suggested-by: Mattias Nissler <mnissler@chromium.org> Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
-rw-r--r--drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
index 4eb1e1ce9ace..ef72baf6dd96 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
@@ -429,7 +429,8 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr,
if (code != BRCMF_E_IF && !fweh->evt_handler[code])
return;
- if (datalen > BRCMF_DCMD_MAXLEN)
+ if (datalen > BRCMF_DCMD_MAXLEN ||
+ datalen + sizeof(*event_packet) > packet_len)
return;
if (in_interrupt())