brcmfmac: Avoid possible out-of-bounds read
authorKevin Cernekee <cernekee@chromium.org>
Sun, 17 Sep 2017 04:08:22 +0000 (21:08 -0700)
committerRaspbian kernel package updater <root@raspbian.org>
Sat, 31 Mar 2018 14:55:28 +0000 (15:55 +0100)
commit21e02ef4d28238966c42c1a6bbcd044246a7a181
treebb3cdaea290bf926418191979c6ec203004dc92f
parentbb2441c325157608dcb9da216fd5e67956b99a0a
brcmfmac: Avoid possible out-of-bounds read

In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before
the length of rxframe is validated.  This could lead to uninitialized
data being accessed (but not printed).  Since we already have a
perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec,
and ch.chspec is not modified by decchspec(), avoid the extra
assignment and use ch.chspec in the debug print.

Suggested-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c