| Message ID | 20190312043929.727-1-kjlu@umn.edu (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [v2] net: brcm80211: fix missing checks for kmemdup | expand |
On 3/12/2019 5:39 AM, Kangjie Lu wrote: > In case kmemdup fails, the fix sets conn_info->req_ie_len to zero > to avoid buffer overflows. Hi Kangjie, See comment below. Also for v3 change prefix 'net:brcm80211:' to 'brcmfmac:' instead. > Signed-off-by: Kangjie Lu <kjlu@umn.edu> > --- > drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > index e92f6351bd22..5d9a3c35fef5 100644 > --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > @@ -5464,6 +5464,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, > conn_info->req_ie = > kmemdup(cfg->extra_buf, conn_info->req_ie_len, > GFP_KERNEL); > + if (!conn_info->req_ie) > + conn_info->req_ie_len = 0; good. > } else { > conn_info->req_ie_len = 0; > conn_info->req_ie = NULL; > @@ -5480,6 +5482,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, > conn_info->resp_ie = > kmemdup(cfg->extra_buf, conn_info->resp_ie_len, > GFP_KERNEL); > + if (!conn_info->resp_ie) > + conn_info->req_ie_len = 0; bad! I think you took my comment too literal. Here it should set conn_info->resp_ie_len to zero. Regards, Arend > } else { > conn_info->resp_ie_len = 0; > conn_info->resp_ie = NULL; >
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index e92f6351bd22..5d9a3c35fef5 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -5464,6 +5464,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, conn_info->req_ie = kmemdup(cfg->extra_buf, conn_info->req_ie_len, GFP_KERNEL); + if (!conn_info->req_ie) + conn_info->req_ie_len = 0; } else { conn_info->req_ie_len = 0; conn_info->req_ie = NULL; @@ -5480,6 +5482,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, conn_info->resp_ie = kmemdup(cfg->extra_buf, conn_info->resp_ie_len, GFP_KERNEL); + if (!conn_info->resp_ie) + conn_info->req_ie_len = 0; } else { conn_info->resp_ie_len = 0; conn_info->resp_ie = NULL;
In case kmemdup fails, the fix sets conn_info->req_ie_len to zero to avoid buffer overflows. Signed-off-by: Kangjie Lu <kjlu@umn.edu> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++++ 1 file changed, 4 insertions(+)