package/kernel/mac80211/patches/328-v4.15-0001-brcmfmac-Avoid-possible-out-of-bounds-read.patch

   1 From 73f2c8e933b1dcf432ac8c6965a6e67af630077f Mon Sep 17 00:00:00 2001
   2 From: Kevin Cernekee <cernekee@chromium.org>
   3 Date: Sat, 16 Sep 2017 21:08:22 -0700
   4 Subject: [PATCH] brcmfmac: Avoid possible out-of-bounds read
   5
   6 In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before
   7 the length of rxframe is validated.  This could lead to uninitialized
   8 data being accessed (but not printed).  Since we already have a
   9 perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec,
  10 and ch.chspec is not modified by decchspec(), avoid the extra
  11 assignment and use ch.chspec in the debug print.
  12
  13 Suggested-by: Mattias Nissler <mnissler@chromium.org>
  14 Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
  15 Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
  16 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  17 ---
  18  drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 +--
  19  1 file changed, 1 insertion(+), 2 deletions(-)
  20
  21 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
  22 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
  23 @@ -1853,7 +1853,6 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probere
  24         struct afx_hdl *afx_hdl = &p2p->afx_hdl;
  25         struct brcmf_cfg80211_vif *vif = ifp->vif;
  26         struct brcmf_rx_mgmt_data *rxframe = (struct brcmf_rx_mgmt_data *)data;
  27 -       u16 chanspec = be16_to_cpu(rxframe->chanspec);
  28         struct brcmu_chan ch;
  29         u8 *mgmt_frame;
  30         u32 mgmt_frame_len;
  31 @@ -1906,7 +1905,7 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probere
  32         cfg80211_rx_mgmt(&vif->wdev, freq, 0, mgmt_frame, mgmt_frame_len, 0);
  33
  34         brcmf_dbg(INFO, "mgmt_frame_len (%d) , e->datalen (%d), chanspec (%04x), freq (%d)\n",
  35 -                 mgmt_frame_len, e->datalen, chanspec, freq);
  36 +                 mgmt_frame_len, e->datalen, ch.chspec, freq);
  37
  38         return 0;
  39  }