diff options
| author | Raveendran Somu <raveendran.somu@cypress.com> | 2020-06-04 02:18:31 -0500 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2020-07-14 12:43:41 +0300 |
| commit | 698bae2e6ea139cd67debf7e8eb064056783b5bf (patch) | |
| tree | bca9e2ffb8ea52e2704cb7badab7053bfd596984 /drivers/net/wireless/broadcom | |
| parent | f555abfe2923076315e55c275677cb42e91497c5 (diff) | |
brcmfmac: To fix kernel crash on out of boundary access
To truncate the additional bytes, if extra bytes have been received.
Current code only have a warning and proceed without handling it.
But in one of the crash reported by DVT, these causes the
crash intermittently. So the processing is limit to the skb->len.
Signed-off-by: Raveendran Somu <raveendran.somu@cypress.com>
Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Wright Feng <wright.feng@cypress.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200604071835.3842-2-wright.feng@cypress.com
Diffstat (limited to 'drivers/net/wireless/broadcom')
| -rw-r--r-- | drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c index 09701262330d..531fe9be4025 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c @@ -1843,6 +1843,9 @@ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb) WARN_ON(siglen > skb->len); + if (siglen > skb->len) + siglen = skb->len; + if (!siglen) return; /* if flow control disabled, skip to packet data and leave */ |