package/kernel/mac80211/patches/353-0001-brcmfmac-avoid-writing-channel-out-of-allocated-arra.patch

   1 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
   2 Date: Wed, 4 Jan 2017 12:09:41 +0100
   3 Subject: [PATCH] brcmfmac: avoid writing channel out of allocated array
   4 MIME-Version: 1.0
   5 Content-Type: text/plain; charset=UTF-8
   6 Content-Transfer-Encoding: 8bit
   7
   8 Our code was assigning number of channels to the index variable by
   9 default. If firmware reported channel we didn't predict this would
  10 result in using that initial index value and writing out of array. This
  11 never happened so far (we got a complete list of supported channels) but
  12 it means possible memory corruption so we should handle it anyway.
  13
  14 This patch simply detects unexpected channel and ignores it.
  15
  16 As we don't try to create new entry now, it's also safe to drop hw_value
  17 and center_freq assignment. For known channels we have these set anyway.
  18
  19 I decided to fix this issue by assigning NULL or a target channel to the
  20 channel variable. This was one of possible ways, I prefefred this one as
  21 it also avoids using channel[index] over and over.
  22
  23 Fixes: 58de92d2f95e ("brcmfmac: use static superset of channels for wiphy bands")
  24 Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  25 Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  26 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  27 ---
  28
  29 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
  30 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
  31 @@ -5913,7 +5913,6 @@ static int brcmf_construct_chaninfo(stru
  32         u32 i, j;
  33         u32 total;
  34         u32 chaninfo;
  35 -       u32 index;
  36
  37         pbuf = kzalloc(BRCMF_DCMD_MEDLEN, GFP_KERNEL);
  38
  39 @@ -5961,33 +5960,36 @@ static int brcmf_construct_chaninfo(stru
  40                     ch.bw == BRCMU_CHAN_BW_80)
  41                         continue;
  42
  43 -               channel = band->channels;
  44 -               index = band->n_channels;
  45 +               channel = NULL;
  46                 for (j = 0; j < band->n_channels; j++) {
  47 -                       if (channel[j].hw_value == ch.control_ch_num) {
  48 -                               index = j;
  49 +                       if (band->channels[j].hw_value == ch.control_ch_num) {
  50 +                               channel = &band->channels[j];
  51                                 break;
  52                         }
  53                 }
  54 -               channel[index].center_freq =
  55 -                       ieee80211_channel_to_frequency(ch.control_ch_num,
  56 -                                                      band->band);
  57 -               channel[index].hw_value = ch.control_ch_num;
  58 +               if (!channel) {
  59 +                       /* It seems firmware supports some channel we never
  60 +                        * considered. Something new in IEEE standard?
  61 +                        */
  62 +                       brcmf_err("Ignoring unexpected firmware channel %d\n",
  63 +                                 ch.control_ch_num);
  64 +                       continue;
  65 +               }
  66
  67                 /* assuming the chanspecs order is HT20,
  68                  * HT40 upper, HT40 lower, and VHT80.
  69                  */
  70                 if (ch.bw == BRCMU_CHAN_BW_80) {
  71 -                       channel[index].flags &= ~IEEE80211_CHAN_NO_80MHZ;
  72 +                       channel->flags &= ~IEEE80211_CHAN_NO_80MHZ;
  73                 } else if (ch.bw == BRCMU_CHAN_BW_40) {
  74 -                       brcmf_update_bw40_channel_flag(&channel[index], &ch);
  75 +                       brcmf_update_bw40_channel_flag(channel, &ch);
  76                 } else {
  77                         /* enable the channel and disable other bandwidths
  78                          * for now as mentioned order assure they are enabled
  79                          * for subsequent chanspecs.
  80                          */
  81 -                       channel[index].flags = IEEE80211_CHAN_NO_HT40 |
  82 -                                              IEEE80211_CHAN_NO_80MHZ;
  83 +                       channel->flags = IEEE80211_CHAN_NO_HT40 |
  84 +                                        IEEE80211_CHAN_NO_80MHZ;
  85                         ch.bw = BRCMU_CHAN_BW_20;
  86                         cfg->d11inf.encchspec(&ch);
  87                         chaninfo = ch.chspec;
  88 @@ -5995,11 +5997,11 @@ static int brcmf_construct_chaninfo(stru
  89                                                        &chaninfo);
  90                         if (!err) {
  91                                 if (chaninfo & WL_CHAN_RADAR)
  92 -                                       channel[index].flags |=
  93 +                                       channel->flags |=
  94                                                 (IEEE80211_CHAN_RADAR |
  95                                                  IEEE80211_CHAN_NO_IR);
  96                                 if (chaninfo & WL_CHAN_PASSIVE)
  97 -                                       channel[index].flags |=
  98 +                                       channel->flags |=
  99                                                 IEEE80211_CHAN_NO_IR;
 100                         }
 101                 }