Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7c9d97f3 authored by Kangjie Lu's avatar Kangjie Lu Committed by Greg Kroah-Hartman
Browse files

brcmfmac: fix missing checks for kmemdup 



[ Upstream commit 46953f97224d56a12ccbe9c6acaa84ca0dab2780 ]

In case kmemdup fails, the fix sets conn_info->req_ie_len and
conn_info->resp_ie_len to zero to avoid buffer overflows.

Signed-off-by: default avatarKangjie Lu <kjlu@umn.edu>
Acked-by: default avatarArend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent a27ce484

drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

+4 −0
Original line number Diff line number Diff line
@@ -5368,6 +5368,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, 
		conn_info->req_ie =

		    kmemdup(cfg->extra_buf, conn_info->req_ie_len,

			    GFP_KERNEL);

		if (!conn_info->req_ie)

			conn_info->req_ie_len = 0;

	} else {

		conn_info->req_ie_len = 0;

		conn_info->req_ie = NULL;
@@ -5384,6 +5386,8 @@ static s32 brcmf_get_assoc_ies(struct brcmf_cfg80211_info *cfg, 
		conn_info->resp_ie =

		    kmemdup(cfg->extra_buf, conn_info->resp_ie_len,

			    GFP_KERNEL);

		if (!conn_info->resp_ie)

			conn_info->resp_ie_len = 0;

	} else {

		conn_info->resp_ie_len = 0;

		conn_info->resp_ie = NULL;