Messages in this thread | | | Subject | Re: [PATCH v2] net: brcm80211: fix missing checks for kmemdup | From | Arend Van Spriel <> | Date | Fri, 15 Mar 2019 10:50:44 +0100 |
| |
On 3/12/2019 5:39 AM, Kangjie Lu wrote: > In case kmemdup fails, the fix sets conn_info->req_ie_len to zero > to avoid buffer overflows.
Hi Kangjie,
See comment below. Also for v3 change prefix 'net:brcm80211:' to 'brcmfmac:' instead.
> Signed-off-by: Kangjie Lu <kjlu@umn.edu> > --- > drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > index e92f6351bd22..5d9a3c35fef5 100644 > --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > @@ -5464,6 +5464,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, > conn_info->req_ie = > kmemdup(cfg->extra_buf, conn_info->req_ie_len, > GFP_KERNEL); > + if (!conn_info->req_ie) > + conn_info->req_ie_len = 0;
good.
> } else { > conn_info->req_ie_len = 0; > conn_info->req_ie = NULL; > @@ -5480,6 +5482,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, > conn_info->resp_ie = > kmemdup(cfg->extra_buf, conn_info->resp_ie_len, > GFP_KERNEL); > + if (!conn_info->resp_ie) > + conn_info->req_ie_len = 0;
bad! I think you took my comment too literal. Here it should set conn_info->resp_ie_len to zero.
Regards, Arend
> } else { > conn_info->resp_ie_len = 0; > conn_info->resp_ie = NULL; >
| |