brcmfmac: Add check for short event packets
authorKevin Cernekee <cernekee@chromium.org>
Sun, 17 Sep 2017 04:08:24 +0000 (21:08 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 27 Oct 2017 08:38:07 +0000 (10:38 +0200)
commit7f9267693f51b8dfa9a597a0fd4323ae0156cd26
tree0cdb7d5f0b3ffb30a5f5b2b596bc49dc6c4b3856
parent717ef37dde6c3b45a1f20f0e709e4fc8e9396e49
brcmfmac: Add check for short event packets

commit dd2349121bb1b8ff688c3ca6a2a0bea9d8c142ca upstream.

The length of the data in the received skb is currently passed into
brcmf_fweh_process_event() as packet_len, but this value is not checked.
event_packet should be followed by DATALEN bytes of additional event
data.  Ensure that the received packet actually contains at least
DATALEN bytes of additional data, to avoid copying uninitialized memory
into event->data.

Suggested-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c