| Message ID | 20170917040824.22237-3-cernekee@chromium.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | dd2349121bb1b8ff688c3ca6a2a0bea9d8c142ca |
| Delegated to: | Kalle Valo |
| Headers | show |
Kevin Cernekee <cernekee@chromium.org> wrote: > The length of the data in the received skb is currently passed into > brcmf_fweh_process_event() as packet_len, but this value is not checked. > event_packet should be followed by DATALEN bytes of additional event > data. Ensure that the received packet actually contains at least > DATALEN bytes of additional data, to avoid copying uninitialized memory > into event->data. > > Suggested-by: Mattias Nissler <mnissler@chromium.org> > Signed-off-by: Kevin Cernekee <cernekee@chromium.org> I'll queue this for v4.14 and add: Cc: stable@vger.kernel.org # v3.8
Kevin Cernekee <cernekee@chromium.org> wrote: > The length of the data in the received skb is currently passed into > brcmf_fweh_process_event() as packet_len, but this value is not checked. > event_packet should be followed by DATALEN bytes of additional event > data. Ensure that the received packet actually contains at least > DATALEN bytes of additional data, to avoid copying uninitialized memory > into event->data. > > Cc: <stable@vger.kernel.org> # v3.8 > Suggested-by: Mattias Nissler <mnissler@chromium.org> > Signed-off-by: Kevin Cernekee <cernekee@chromium.org> Patch applied to wireless-drivers.git, thanks. dd2349121bb1 brcmfmac: Add check for short event packets
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c index 27e661fa356f..e7eaa57d11d9 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c @@ -424,7 +424,8 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr, if (code != BRCMF_E_IF && !fweh->evt_handler[code]) return; - if (datalen > BRCMF_DCMD_MAXLEN) + if (datalen > BRCMF_DCMD_MAXLEN || + datalen + sizeof(*event_packet) > packet_len) return; if (in_interrupt())
The length of the data in the received skb is currently passed into brcmf_fweh_process_event() as packet_len, but this value is not checked. event_packet should be followed by DATALEN bytes of additional event data. Ensure that the received packet actually contains at least DATALEN bytes of additional data, to avoid copying uninitialized memory into event->data. Suggested-by: Mattias Nissler <mnissler@chromium.org> Signed-off-by: Kevin Cernekee <cernekee@chromium.org> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) V2->V3: Change '<' to '>' and retest