Commit dd234912 authored by Kevin Cernekee's avatar Kevin Cernekee Committed by Kalle Valo

brcmfmac: Add check for short event packets

The length of the data in the received skb is currently passed into
brcmf_fweh_process_event() as packet_len, but this value is not checked.
event_packet should be followed by DATALEN bytes of additional event
data.  Ensure that the received packet actually contains at least
DATALEN bytes of additional data, to avoid copying uninitialized memory
into event->data.

Cc: <stable@vger.kernel.org> # v3.8
Suggested-by: default avatarMattias Nissler <mnissler@chromium.org>
Signed-off-by: default avatarKevin Cernekee <cernekee@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent b8b8b163
...@@ -429,7 +429,8 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr, ...@@ -429,7 +429,8 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr,
if (code != BRCMF_E_IF && !fweh->evt_handler[code]) if (code != BRCMF_E_IF && !fweh->evt_handler[code])
return; return;
if (datalen > BRCMF_DCMD_MAXLEN) if (datalen > BRCMF_DCMD_MAXLEN ||
datalen + sizeof(*event_packet) > packet_len)
return; return;
if (in_interrupt()) if (in_interrupt())
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment