package/kernel/mac80211/patches/319-0026-brcmfmac-fix-clearing-entry-IPv6-address.patch

   1 From 2b7425f3629b38c438f890c20c5faeca64b144ff Mon Sep 17 00:00:00 2001
   2 From: Hante Meuleman <hante.meuleman@broadcom.com>
   3 Date: Mon, 19 Sep 2016 12:09:57 +0100
   4 Subject: [PATCH] brcmfmac: fix clearing entry IPv6 address
   5
   6 When IPv6 address is to be cleared there is a possible out of
   7 bound access. But also the clearing of the last entry and the
   8 adjustment of total number of stored IPv6 addresses is not
   9 updated. This patch fixes that bug. Bug was found using coverity.
  10
  11 Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
  12 Reviewed-by: Franky Lin <franky.lin@broadcom.com>
  13 Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
  14 Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
  15 Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  16 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  17 ---
  18  drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 7 +++++--
  19  1 file changed, 5 insertions(+), 2 deletions(-)
  20
  21 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
  22 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
  23 @@ -873,9 +873,12 @@ static int brcmf_inet6addr_changed(struc
  24                 }
  25                 break;
  26         case NETDEV_DOWN:
  27 -               if (i < NDOL_MAX_ENTRIES)
  28 -                       for (; i < ifp->ipv6addr_idx; i++)
  29 +               if (i < NDOL_MAX_ENTRIES) {
  30 +                       for (; i < ifp->ipv6addr_idx - 1; i++)
  31                                 table[i] = table[i + 1];
  32 +                       memset(&table[i], 0, sizeof(table[i]));
  33 +                       ifp->ipv6addr_idx--;
  34 +               }
  35                 break;
  36         default:
  37                 break;