brcmfmac: Avoid possible out-of-bounds read
authorKevin Cernekee <cernekee@chromium.org>
Sun, 17 Sep 2017 04:08:22 +0000 (21:08 -0700)
committerRaspbian kernel package updater <root@raspbian.org>
Thu, 15 Feb 2018 17:39:16 +0000 (17:39 +0000)
commit3bf8ec61a9a378bc422089179246a1389c544a38
treec57741156ae9acc9c95c3dcbb5ab741db8dc0f74
parent481c225a491dcbdbdc2228a7a80efda74521052a
brcmfmac: Avoid possible out-of-bounds read

In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before
the length of rxframe is validated.  This could lead to uninitialized
data being accessed (but not printed).  Since we already have a
perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec,
and ch.chspec is not modified by decchspec(), avoid the extra
assignment and use ch.chspec in the debug print.

Suggested-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c