diff options
| author | Raveendran Somu <raveendran.somu@cypress.com> | 2018-11-12 20:32:11 -0600 |
|---|---|---|
| committer | Fugang Duan <fugang.duan@nxp.com> | 2019-03-18 14:23:17 +0800 |
| commit | f7112c027e0c7447b05474b72934589bbbb8e298 (patch) | |
| tree | d06d9dffe25c84216dbb24a4260cfa07cf7e636d /drivers/net/wireless/broadcom/brcm80211 | |
| parent | 16fd0aee0084043e321505937887a9bca90833df (diff) | |
MLK-21161-01 brcmfmac: To fix kernel crash on out of boundary access
To trunkcate the addtional bytes, if extra bytes are received.
Current code only have a warning and proceed without handling it.
But in one crash dump reported by DVT, these causes the
crash intermittently. So the processing is limit to the skb->len.
Signed-off-by: Raveendran Somu <raveendran.somu@cypress.com>
Signed-off-by: Fugang Duan <fugang.duan@nxp.com>
Diffstat (limited to 'drivers/net/wireless/broadcom/brcm80211')
| -rw-r--r-- | drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c index ea87a2182ead..01cc628f3b9a 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwsignal.c @@ -1868,6 +1868,9 @@ void brcmf_fws_hdrpull(struct brcmf_if *ifp, s16 siglen, struct sk_buff *skb) WARN_ON(siglen > skb->len); + if (siglen > skb->len) + siglen = skb->len; + if (!siglen) return; /* if flow control disabled, skip to packet data and leave */ |