From 45b73af7f6020b1c3e3d7170d3b1ba86edabfc60 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= Date: Tue, 27 Sep 2016 06:58:01 +0200 Subject: mac80211: backport brcmfmac changes from 2016-09-26 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All these patches are in wireless-drirvers-next. There is support for hidden SSID, few new devices and many fixes. Signed-off-by: Rafał Miłecki --- ...x-out-of-bound-access-on-clearing-wowl-wa.patch | 44 ++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 package/kernel/mac80211/patches/319-0027-brcmfmac-fix-out-of-bound-access-on-clearing-wowl-wa.patch (limited to 'package/kernel/mac80211/patches/319-0027-brcmfmac-fix-out-of-bound-access-on-clearing-wowl-wa.patch') diff --git a/package/kernel/mac80211/patches/319-0027-brcmfmac-fix-out-of-bound-access-on-clearing-wowl-wa.patch b/package/kernel/mac80211/patches/319-0027-brcmfmac-fix-out-of-bound-access-on-clearing-wowl-wa.patch new file mode 100644 index 0000000000..4a005d608a --- /dev/null +++ b/package/kernel/mac80211/patches/319-0027-brcmfmac-fix-out-of-bound-access-on-clearing-wowl-wa.patch @@ -0,0 +1,44 @@ +From a7ed7828ecda0c2b5e0d7f55dedd4230afd4b583 Mon Sep 17 00:00:00 2001 +From: Hante Meuleman +Date: Mon, 19 Sep 2016 12:09:58 +0100 +Subject: [PATCH] brcmfmac: fix out of bound access on clearing wowl wake + indicator + +Clearing the wowl wakeindicator happens with a rather odd +construction where the string "clear" is used to set the iovar +wowl_wakeind. This was implemented incorrectly as it caused an +out of bound access. Use an intermediate variable of correct +length and copy string in that. Problem was found using coverity. + +Reviewed-by: Arend Van Spriel +Reviewed-by: Franky Lin +Reviewed-by: Pieter-Paul Giesberts +Signed-off-by: Hante Meuleman +Signed-off-by: Arend van Spriel +Signed-off-by: Kalle Valo +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -3699,6 +3699,7 @@ static void brcmf_configure_wowl(struct + struct cfg80211_wowlan *wowl) + { + u32 wowl_config; ++ struct brcmf_wowl_wakeind_le wowl_wakeind; + u32 i; + + brcmf_dbg(TRACE, "Suspend, wowl config.\n"); +@@ -3740,8 +3741,9 @@ static void brcmf_configure_wowl(struct + if (!test_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state)) + wowl_config |= BRCMF_WOWL_UNASSOC; + +- brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", "clear", +- sizeof(struct brcmf_wowl_wakeind_le)); ++ memcpy(&wowl_wakeind, "clear", 6); ++ brcmf_fil_iovar_data_set(ifp, "wowl_wakeind", &wowl_wakeind, ++ sizeof(wowl_wakeind)); + brcmf_fil_iovar_int_set(ifp, "wowl", wowl_config); + brcmf_fil_iovar_int_set(ifp, "wowl_activate", 1); + brcmf_bus_wowl_config(cfg->pub->bus_if, true); -- cgit v1.2.3