diff options
| author | Guisen Yang <guiseny@codeaurora.org> | 2018-07-05 13:41:10 +0800 |
|---|---|---|
| committer | Ke Huang <keh@codeaurora.org> | 2018-10-09 09:21:30 +0800 |
| commit | 09451680168a3b46d563c3ea4e070ec4f419f9ed (patch) | |
| tree | 315d6cbebe771904cfdc202d0b50743ca68cf304 | |
| parent | 3b8fc0b7a3fcc809378d82dbf66b417e186af205 (diff) | |
net:wireless:Fix kw issues
Fix the uninitialized variables used, NULL pointer dereference,
and potential array OOB.
Change-Id: I0787eaa377bf2bd29d5ddeabafa8f4e1c6a81919
CRs-Fixed: 2272639
Signed-off-by: Guisen Yang <guiseny@codeaurora.org>
| -rw-r--r-- | net/wireless/nl80211.c | 3 | ||||
| -rw-r--r-- | net/wireless/sme.c | 2 | ||||
| -rw-r--r-- | net/wireless/util.c | 1 |
3 files changed, 5 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 0a13d55cb4d3..e4b9dd99b82d 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -7687,6 +7687,9 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, if (settings->n_ciphers_pairwise > cipher_limit) return -EINVAL; + if (len > sizeof(u32) * NL80211_MAX_NR_CIPHER_SUITES) + return -EINVAL; + memcpy(settings->ciphers_pairwise, data, len); for (i = 0; i < settings->n_ciphers_pairwise; i++) diff --git a/net/wireless/sme.c b/net/wireless/sme.c index 85c12c7d0ed1..6ccaaa3365b9 100644 --- a/net/wireless/sme.c +++ b/net/wireless/sme.c @@ -498,7 +498,7 @@ static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev, if (!buf) return -ENOMEM; - if (ies_len) { + if (ies_len && ies) { static const u8 before_extcapa[] = { /* not listing IEs expected to be created by driver */ WLAN_EID_RSN, diff --git a/net/wireless/util.c b/net/wireless/util.c index afdbc1200a1b..e50092658fcc 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -591,6 +591,7 @@ int ieee80211_data_from_8023(struct sk_buff *skb, const u8 *addr, hdr.frame_control = fc; hdr.duration_id = 0; hdr.seq_ctrl = 0; + eth_zero_addr(hdr.addr4); skip_header_bytes = ETH_HLEN; if (ethertype == ETH_P_AARP || ethertype == ETH_P_IPX) { |