brcmfmac: Add check for short event packets
authorKevin Cernekee <cernekee@chromium.org>
Sun, 17 Sep 2017 04:08:24 +0000 (21:08 -0700)
committerPhil Elwell <phil@raspberrypi.org>
Mon, 2 Oct 2017 19:51:54 +0000 (20:51 +0100)
commit8af328b2e65c58f5d7153b03a18f314a371c8fd1
treed5345c1e9762921a96169f7b3b24bdc78e0c5df1
parentdf4cc150317213a4d8af88acaa5735999b660391
brcmfmac: Add check for short event packets

The length of the data in the received skb is currently passed into
brcmf_fweh_process_event() as packet_len, but this value is not checked.
event_packet should be followed by DATALEN bytes of additional event
data.  Ensure that the received packet actually contains at least
DATALEN bytes of additional data, to avoid copying uninitialized memory
into event->data.

Suggested-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c