]> git.baikalelectronics.ru Git - kernel.git/commit
brcmfmac: avoid writing channel out of allocated array
authorRafał Miłecki <rafal@milecki.pl>
Wed, 4 Jan 2017 11:09:41 +0000 (12:09 +0100)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 17 Jan 2017 11:56:35 +0000 (13:56 +0200)
commit5f24117ff2af778a060778a1e699fb67b2acd1f9
tree185e6832afaa053e5bab14533a9adbdfadac728d
parentc3e1a6daa00c6481519e303a2c469e3d69ba2f0f
brcmfmac: avoid writing channel out of allocated array

Our code was assigning number of channels to the index variable by
default. If firmware reported channel we didn't predict this would
result in using that initial index value and writing out of array. This
never happened so far (we got a complete list of supported channels) but
it means possible memory corruption so we should handle it anyway.

This patch simply detects unexpected channel and ignores it.

As we don't try to create new entry now, it's also safe to drop hw_value
and center_freq assignment. For known channels we have these set anyway.

I decided to fix this issue by assigning NULL or a target channel to the
channel variable. This was one of possible ways, I prefefred this one as
it also avoids using channel[index] over and over.

Fixes: 4ddcaab69b42 ("brcmfmac: use static superset of channels for wiphy bands")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c