package/kernel/mac80211/patches/326-v4.14-0005-brcmfmac-Add-check-for-short-event-packets.patch

   1 From dd2349121bb1b8ff688c3ca6a2a0bea9d8c142ca Mon Sep 17 00:00:00 2001
   2 From: Kevin Cernekee <cernekee@chromium.org>
   3 Date: Sat, 16 Sep 2017 21:08:24 -0700
   4 Subject: [PATCH] brcmfmac: Add check for short event packets
   5
   6 The length of the data in the received skb is currently passed into
   7 brcmf_fweh_process_event() as packet_len, but this value is not checked.
   8 event_packet should be followed by DATALEN bytes of additional event
   9 data.  Ensure that the received packet actually contains at least
  10 DATALEN bytes of additional data, to avoid copying uninitialized memory
  11 into event->data.
  12
  13 Cc: <stable@vger.kernel.org> # v3.8
  14 Suggested-by: Mattias Nissler <mnissler@chromium.org>
  15 Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
  16 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  17 ---
  18  drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 3 ++-
  19  1 file changed, 2 insertions(+), 1 deletion(-)
  20
  21 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
  22 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
  23 @@ -429,7 +429,8 @@ void brcmf_fweh_process_event(struct brc
  24         if (code != BRCMF_E_IF && !fweh->evt_handler[code])
  25                 return;
  26
  27 -       if (datalen > BRCMF_DCMD_MAXLEN)
  28 +       if (datalen > BRCMF_DCMD_MAXLEN ||
  29 +           datalen + sizeof(*event_packet) > packet_len)
  30                 return;
  31
  32         if (in_interrupt())