]> git.baikalelectronics.ru Git - kernel.git/commit
brcmfmac: Add check for short event packets
authorKevin Cernekee <cernekee@chromium.org>
Sun, 17 Sep 2017 04:08:24 +0000 (21:08 -0700)
committerKalle Valo <kvalo@codeaurora.org>
Mon, 2 Oct 2017 13:51:21 +0000 (16:51 +0300)
commit4b13cd44f32baa571c2d64a01a95ea96a264d27f
treeba8b84deba9a4702f5ea71520dba1169f9ee099e
parentc53362d951c97ee118d4c0dc847bc63cb38c6c3f
brcmfmac: Add check for short event packets

The length of the data in the received skb is currently passed into
brcmf_fweh_process_event() as packet_len, but this value is not checked.
event_packet should be followed by DATALEN bytes of additional event
data.  Ensure that the received packet actually contains at least
DATALEN bytes of additional data, to avoid copying uninitialized memory
into event->data.

Cc: <stable@vger.kernel.org> # v3.8
Suggested-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c