• Rafał Miłecki's avatar
    brcmfmac: avoid writing channel out of allocated array · 77c0d0cd
    Rafał Miłecki authored
    Our code was assigning number of channels to the index variable by
    default. If firmware reported channel we didn't predict this would
    result in using that initial index value and writing out of array. This
    never happened so far (we got a complete list of supported channels) but
    it means possible memory corruption so we should handle it anyway.
    
    This patch simply detects unexpected channel and ignores it.
    
    As we don't try to create new entry now, it's also safe to drop hw_value
    and center_freq assignment. For known channels we have these set anyway.
    
    I decided to fix this issue by assigning NULL or a target channel to the
    channel variable. This was one of possible ways, I prefefred this one as
    it also avoids using channel[index] over and over.
    
    Fixes: 58de92d2 ("brcmfmac: use static superset of channels for wiphy bands")
    Signed-off-by: default avatarRafał Miłecki <rafal@milecki.pl>
    Acked-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    77c0d0cd
cfg80211.c 186 KB