evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

staging: rtl8723au: Check kmalloc return value and fix size of memcpy()

Browse source 
Check kmalloc() return before dereferencing bssid in
rtw_check_bcn_info23a() and use the correct size to copy
rtw_basic_rate_ofdm in update_bmc_sta_support_rate23a()

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jes Sorensen 2014-04-26 18:54:49 +02:00 • committed by Greg Kroah-Hartman
parent 7591ba8be2
commit 5bd28bc2e4
2 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/staging/rtl8723au/core/rtw_mlme_ext.c
View file

@ -4510,7 +4510,7 @@ u8 collect_bss_info23a(struct rtw_adapter *padapter,
}
ie_offset -= offsetof(struct ieee80211_mgmt, u);
bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + length;
bssid->Length = offsetof(struct wlan_bssid_ex, IEs) + length;
/* below is to copy the information element */
bssid->IELength = length;

14
drivers/staging/rtl8723au/core/rtw_wlan_util.c
View file

@ -899,15 +899,17 @@ int rtw_check_bcn_info23a(struct rtw_adapter *Adapter,
}
bssid = (struct wlan_bssid_ex *)kzalloc(sizeof(struct wlan_bssid_ex),
GFP_ATOMIC);
GFP_ATOMIC);
if (!bssid)
return _FAIL;
bssid->reserved = 1;
bssid->Length = sizeof(struct wlan_bssid_ex) - MAX_IE_SZ + len;
bssid->Length = offsetof(struct wlan_bssid_ex, IEs) + len;
/* below is to copy the information element */
bssid->IELength = len;
memcpy(bssid->IEs, &mgmt->u, bssid->IELength);
memcpy(bssid->IEs, &mgmt->u, len);
/* check bw and channel offset */
/* parsing HT_CAP_IE */
@ -1589,9 +1591,11 @@ void update_bmc_sta_support_rate23a(struct rtw_adapter *padapter, u32 mac_id)
if (pmlmeext->cur_wireless_mode & WIRELESS_11B) {
/* Only B, B/G, and B/G/N AP could use CCK rate */
memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), rtw_basic_rate_cck, 4);
memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates),
rtw_basic_rate_cck, 4);
} else {
memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates), rtw_basic_rate_ofdm, 4);
memcpy((pmlmeinfo->FW_sta_info[mac_id].SupportedRates),
rtw_basic_rate_ofdm, 3);
}
}