source: branches/chaos_calmer/package/kernel/mac80211/patches/351-0045-brcmfmac-fix-clearing-entry-IPv6-address.patch @ 49407

Last change on this file since 49407 was 49407, checked in by rmilecki, 12 months ago

mac80211: brcmfmac: backport changes from 2016-09-27

This fixes memory leaks, some possible crashes and bug that could cause
WARNING on every add_key/del_key call. It also replaces WARNING with
a simple message. They may still occur e.g. on station going out of
range and A-MPDU stall in the firmware.

Signed-off-by: Rafał Miłecki <rafal@…>

File size: 1.4 KB
  • drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c

    From 2b7425f3629b38c438f890c20c5faeca64b144ff Mon Sep 17 00:00:00 2001
    From: Hante Meuleman <hante.meuleman@broadcom.com>
    Date: Mon, 19 Sep 2016 12:09:57 +0100
    Subject: [PATCH] brcmfmac: fix clearing entry IPv6 address
    
    When IPv6 address is to be cleared there is a possible out of
    bound access. But also the clearing of the last entry and the
    adjustment of total number of stored IPv6 addresses is not
    updated. This patch fixes that bug. Bug was found using coverity.
    
    Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
    Reviewed-by: Franky Lin <franky.lin@broadcom.com>
    Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
    Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
    Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    ---
     drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 7 +++++--
     1 file changed, 5 insertions(+), 2 deletions(-)
    
    a b static int brcmf_inet6addr_changed(struc 
    873873                } 
    874874                break; 
    875875        case NETDEV_DOWN: 
    876                 if (i < NDOL_MAX_ENTRIES) 
    877                         for (; i < ifp->ipv6addr_idx; i++) 
     876                if (i < NDOL_MAX_ENTRIES) { 
     877                        for (; i < ifp->ipv6addr_idx - 1; i++) 
    878878                                table[i] = table[i + 1]; 
     879                        memset(&table[i], 0, sizeof(table[i])); 
     880                        ifp->ipv6addr_idx--; 
     881                } 
    879882                break; 
    880883        default: 
    881884                break; 
Note: See TracBrowser for help on using the repository browser.