Dan Carpenter a898d15095 brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler() ... [ Upstream commit e025da3d7aa4770bb1d1b3b0aa7cc4da1744852d ] If "ret_len" is negative then it could lead to a NULL dereference. The "ret_len" value comes from nl80211_vendor_cmd(), if it's negative then we don't allocate the "dcmd_buf" buffer. Then we pass "ret_len" to brcmf_fil_cmd_data_set() where it is cast to a very high u32 value. Most of the functions in that call tree check whether the buffer we pass is NULL but there are at least a couple places which don't such as brcmf_dbg_hex_dump() and brcmf_msgbuf_query_dcmd(). We memcpy() to and from the buffer so it would result in a NULL dereference. The fix is to change the types so that "ret_len" can't be negative. (If we memcpy() zero bytes to NULL, that's a no-op and doesn't cause an issue). Fixes: 1bacb0487d ("brcmfmac: replace cfg80211 testmode with vendor command") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2019-06-11 12:23:54 +02:00
..
brcmfmac	brcm80211: potential NULL dereference in brcmf_cfg80211_vndr_cmds_dcmd_handler()	2019-06-11 12:23:54 +02:00
brcmsmac	brcmsmac: make some local variables 'static const' to reduce stack size	2017-10-27 10:23:16 +02:00
brcmutil
include
Kconfig
Makefile