brcmfmac: Avoid possible out-of-bounds read
authorKevin Cernekee <cernekee@chromium.org>
Sun, 17 Sep 2017 04:08:22 +0000 (21:08 -0700)
committerRaspbian kernel package updater <root@raspbian.org>
Sun, 8 Oct 2017 01:09:29 +0000 (01:09 +0000)
commited1ee7b11052ac53b43e124986a744e40a3780aa
tree6e4845264d18d3f866de14c3f52caec7976d271e
parentf08d3af55a801bad2e17bb7b312a3a39025668fc
brcmfmac: Avoid possible out-of-bounds read

In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before
the length of rxframe is validated.  This could lead to uninitialized
data being accessed (but not printed).  Since we already have a
perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec,
and ch.chspec is not modified by decchspec(), avoid the extra
assignment and use ch.chspec in the debug print.

Suggested-by: Mattias Nissler <mnissler@chromium.org>
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Reviewed-by: Arend van Spriel <arend.vanspriel@broadcom.com>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c