Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3f161534 authored by Pontus Fuchs's avatar Pontus Fuchs Committed by Kalle Valo
Browse files

brcmfmac: Perform bound checking on vendor command buffer 



A short or malformed vendor command buffer could cause reads outside
the command buffer.

Cc: stable@vger.kernel.org # v3.19
Signed-off-by: default avatarPontus Fuchs <pontusf@broadcom.com>
[arend@broadcom.com: slightly modified debug trace output]
Signed-off-by: default avatarArend van Spriel <arend@broadcom.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent eb9f75d8

drivers/net/wireless/brcm80211/brcmfmac/vendor.c

+12 −3
Original line number Diff line number Diff line
@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy, 
	void *dcmd_buf = NULL, *wr_pointer;

	u16 msglen, maxmsglen = PAGE_SIZE - 0x100;



	brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,

		  cmdhdr->len);

	if (len < sizeof(*cmdhdr)) {

		brcmf_err("vendor command too short: %d\n", len);

		return -EINVAL;

	}



	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);

	ifp = vif->ifp;



	len -= sizeof(struct brcmf_vndr_dcmd_hdr);

	brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);



	if (cmdhdr->offset > len) {

		brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);

		return -EINVAL;

	}



	len -= cmdhdr->offset;

	ret_len = cmdhdr->len;

	if (ret_len > 0 || len > 0) {

		if (len > BRCMF_DCMD_MAXLEN) {