From: Phil Elwell <phil@raspberrypi•com>
To: Arend van Spriel <aspriel@gmail•com>,
Chung-hsien Hsu <chung-hsien.hsu@infineon•com>,
Kalle Valo <kvalo@kernel•org>,
"David S. Miller" <davem@davemloft•net>,
Jakub Kicinski <kuba@kernel•org>,
Linus Walleij <linus.walleij@linaro•org>,
Phil Elwell <phil@raspberrypi•com>,
linux-wireless@vger•kernel.org,
brcm80211-dev-list.pdl@broadcom•com,
SHA-cyfmac-dev-list@infineon•com
Subject: [PATCH] brcmfmac: firmware: Fix crash in brcm_alt_fw_path
Date: Tue, 18 Jan 2022 15:45:14 +0000 [thread overview]
Message-ID: <20220118154514.3245524-1-phil@raspberrypi.com> (raw)
The call to brcm_alt_fw_path in brcmf_fw_get_firmwares is not protected
by a check to the validity of the fwctx->req->board_type pointer. This
results in a crash in strlcat when, for example, the WLAN chip is found
in a USB dongle.
Prevent the crash by adding the necessary check.
See: https://github.com/raspberrypi/linux/issues/4833
Fixes: 5ff013914c62 ("brcmfmac: firmware: Allow per-board firmware binaries")
Signed-off-by: Phil Elwell <phil@raspberrypi•com>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
index 0eb13e5df5177..d99140960a820 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
@@ -693,7 +693,7 @@ int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
{
struct brcmf_fw_item *first = &req->items[0];
struct brcmf_fw *fwctx;
- char *alt_path;
+ char *alt_path = NULL;
int ret;
brcmf_dbg(TRACE, "enter: dev=%s\n", dev_name(dev));
@@ -712,7 +712,9 @@ int brcmf_fw_get_firmwares(struct device *dev, struct brcmf_fw_request *req,
fwctx->done = fw_cb;
/* First try alternative board-specific path if any */
- alt_path = brcm_alt_fw_path(first->path, fwctx->req->board_type);
+ if (fwctx->req->board_type)
+ alt_path = brcm_alt_fw_path(first->path,
+ fwctx->req->board_type);
if (alt_path) {
ret = request_firmware_nowait(THIS_MODULE, true, alt_path,
fwctx->dev, GFP_KERNEL, fwctx,
--
2.25.1
next reply other threads:[~2022-01-18 15:45 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-01-18 15:45 Phil Elwell [this message]
2022-01-19 6:01 ` [PATCH] brcmfmac: firmware: Fix crash in brcm_alt_fw_path Kalle Valo
2022-01-19 8:53 ` Phil Elwell
2022-01-19 10:00 ` Kalle Valo
2022-01-19 15:48 ` Arend van Spriel
2022-01-27 12:08 ` Kalle Valo
2022-01-27 12:59 ` Arend van Spriel
2022-01-27 13:17 ` Kalle Valo
2022-01-27 14:30 ` Arend van Spriel
2022-01-27 15:36 ` Kalle Valo
2022-01-27 16:22 ` Arend van Spriel
2022-01-28 14:07 ` Kalle Valo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220118154514.3245524-1-phil@raspberrypi.com \
--to=phil@raspberrypi$(echo .)com \
--cc=SHA-cyfmac-dev-list@infineon$(echo .)com \
--cc=aspriel@gmail$(echo .)com \
--cc=brcm80211-dev-list.pdl@broadcom$(echo .)com \
--cc=chung-hsien.hsu@infineon$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=kuba@kernel$(echo .)org \
--cc=kvalo@kernel$(echo .)org \
--cc=linus.walleij@linaro$(echo .)org \
--cc=linux-wireless@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox