Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a6958075 authored by Alexei Avshalom Lazar's avatar Alexei Avshalom Lazar Committed by Greg Kroah-Hartman
Browse files

wil6210: check null pointer in _wil_cfg80211_merge_extra_ies 



[ Upstream commit de77a53c2d1e8fb3621e63e8e1f0f0c9a1a99ff7 ]

ies1 or ies2 might be null when code inside
_wil_cfg80211_merge_extra_ies access them.
Add explicit check for null and make sure ies1/ies2 are not
accessed in such a case.

spos might be null and be accessed inside
_wil_cfg80211_merge_extra_ies.
Add explicit check for null in the while condition statement
and make sure spos is not accessed in such a case.

Signed-off-by: default avatarAlexei Avshalom Lazar <ailizaro@codeaurora.org>
Signed-off-by: default avatarMaya Erez <merez@codeaurora.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ae0c4d32

drivers/net/wireless/ath/wil6210/cfg80211.c

+11 −3
Original line number Diff line number Diff line
@@ -1005,6 +1005,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, 
	u8 *buf, *dpos;

	const u8 *spos;



	if (!ies1)

		ies1_len = 0;



	if (!ies2)

		ies2_len = 0;



	if (ies1_len == 0 && ies2_len == 0) {

		*merged_ies = NULL;

		*merged_len = 0;
@@ -1014,17 +1020,19 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, 
	buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);

	if (!buf)

		return -ENOMEM;

	if (ies1)

		memcpy(buf, ies1, ies1_len);

	dpos = buf + ies1_len;

	spos = ies2;

	while (spos + 1 < ies2 + ies2_len) {

	while (spos && (spos + 1 < ies2 + ies2_len)) {

		/* IE tag at offset 0, length at offset 1 */

		u16 ielen = 2 + spos[1];



		if (spos + ielen > ies2 + ies2_len)

			break;

		if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&

		    !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) {

		    (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len,

						     spos, ielen))) {

			memcpy(dpos, spos, ielen);

			dpos += ielen;

		}