| Message ID | 20190315170433.3845-1-kjlu@umn.edu (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 46953f97224d56a12ccbe9c6acaa84ca0dab2780 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [v3] brcmfmac: fix missing checks for kmemdup | expand |
On 3/15/2019 6:04 PM, Kangjie Lu wrote: > In case kmemdup fails, the fix sets conn_info->req_ie_len and > conn_info->resp_ie_len to zero to avoid buffer overflows. Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> > Signed-off-by: Kangjie Lu <kjlu@umn.edu> > --- > drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++++ > 1 file changed, 4 insertions(+)
Kangjie Lu <kjlu@umn.edu> wrote: > In case kmemdup fails, the fix sets conn_info->req_ie_len and > conn_info->resp_ie_len to zero to avoid buffer overflows. > > Signed-off-by: Kangjie Lu <kjlu@umn.edu> > Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Patch applied to wireless-drivers-next.git, thanks. 46953f97224d brcmfmac: fix missing checks for kmemdup
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index e92f6351bd22..8ee8af4e7ec4 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -5464,6 +5464,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, conn_info->req_ie = kmemdup(cfg->extra_buf, conn_info->req_ie_len, GFP_KERNEL); + if (!conn_info->req_ie) + conn_info->req_ie_len = 0; } else { conn_info->req_ie_len = 0; conn_info->req_ie = NULL; @@ -5480,6 +5482,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, conn_info->resp_ie = kmemdup(cfg->extra_buf, conn_info->resp_ie_len, GFP_KERNEL); + if (!conn_info->resp_ie) + conn_info->resp_ie_len = 0; } else { conn_info->resp_ie_len = 0; conn_info->resp_ie = NULL;
In case kmemdup fails, the fix sets conn_info->req_ie_len and conn_info->resp_ie_len to zero to avoid buffer overflows. Signed-off-by: Kangjie Lu <kjlu@umn.edu> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++++ 1 file changed, 4 insertions(+)