lkml.org 
[lkml]   [2019]   [Mar]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.19 047/192] wil6210: check null pointer in _wil_cfg80211_merge_extra_ies
    Date
    From: Alexei Avshalom Lazar <ailizaro@codeaurora.org>

    [ Upstream commit de77a53c2d1e8fb3621e63e8e1f0f0c9a1a99ff7 ]

    ies1 or ies2 might be null when code inside
    _wil_cfg80211_merge_extra_ies access them.
    Add explicit check for null and make sure ies1/ies2 are not
    accessed in such a case.

    spos might be null and be accessed inside
    _wil_cfg80211_merge_extra_ies.
    Add explicit check for null in the while condition statement
    and make sure spos is not accessed in such a case.

    Signed-off-by: Alexei Avshalom Lazar <ailizaro@codeaurora.org>
    Signed-off-by: Maya Erez <merez@codeaurora.org>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/ath/wil6210/cfg80211.c | 14 +++++++++++---
    1 file changed, 11 insertions(+), 3 deletions(-)

    diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
    index f79c337105cb..2daf33342b23 100644
    --- a/drivers/net/wireless/ath/wil6210/cfg80211.c
    +++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
    @@ -1420,6 +1420,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
    u8 *buf, *dpos;
    const u8 *spos;

    + if (!ies1)
    + ies1_len = 0;
    +
    + if (!ies2)
    + ies2_len = 0;
    +
    if (ies1_len == 0 && ies2_len == 0) {
    *merged_ies = NULL;
    *merged_len = 0;
    @@ -1429,17 +1435,19 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len,
    buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);
    if (!buf)
    return -ENOMEM;
    - memcpy(buf, ies1, ies1_len);
    + if (ies1)
    + memcpy(buf, ies1, ies1_len);
    dpos = buf + ies1_len;
    spos = ies2;
    - while (spos + 1 < ies2 + ies2_len) {
    + while (spos && (spos + 1 < ies2 + ies2_len)) {
    /* IE tag at offset 0, length at offset 1 */
    u16 ielen = 2 + spos[1];

    if (spos + ielen > ies2 + ies2_len)
    break;
    if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&
    - !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) {
    + (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len,
    + spos, ielen))) {
    memcpy(dpos, spos, ielen);
    dpos += ielen;
    }
    --
    2.19.1
    \
     
     \ /
      Last update: 2019-03-27 20:09    [W:2.638 / U:0.820 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site