brcmfmac: Avoid possible out-of-bounds read
authorKevin Cernekee <cernekee@chromium.org>
Sun, 17 Sep 2017 04:08:22 +0000 (21:08 -0700)
committerPhil Elwell <phil@raspberrypi.org>
Mon, 2 Oct 2017 19:51:52 +0000 (20:51 +0100)
commit50e4f16d44759cb6b7d071ae76ed769f3e6daff5
tree9084036f0dca34e2fc06ddfd272c978eb10056d5
parent7dc3bd00d62130ef7f09759a8c0ec9d65f58c987
brcmfmac: Avoid possible out-of-bounds read

In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before
the length of rxframe is validated.  This could lead to uninitialized
data being accessed (but not printed).  Since we already have a
perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec,
and ch.chspec is not modified by decchspec(), avoid the extra
assignment and use ch.chspec in the debug print.

Suggested-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c