brcmfmac: firmware: Fix crash in brcm_alt_fw_path
authorPhil Elwell <phil@raspberrypi.com>
Tue, 18 Jan 2022 15:45:14 +0000 (15:45 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 23 Feb 2022 11:03:11 +0000 (12:03 +0100)
commitc4caf72a42d3ab1e059cc50897caca11d813698c
tree89fe665f49068d86660338e64468e49c658d7463
parent00fb850c8a1a9893351ca52e56dc0bfc6ce20597
brcmfmac: firmware: Fix crash in brcm_alt_fw_path

commit 665408f4c3a5c83e712871daa062721624b2b79e upstream.

The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected
by a check to the validity of the fwctx->req->board_type pointer. This
results in a crash in strlcat when, for example, the WLAN chip is found
in a USB dongle.

Prevent the crash by adding the necessary check.

See: https://github.com/raspberrypi/linux/issues/4833

Fixes: 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware binaries")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220118154514.3245524-1-phil@raspberrypi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c