Arend van Spriel 8f44c9a413 brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() ... The lower level nl80211 code in cfg80211 ensures that "len" is between 25 and NL80211_ATTR_FRAME (2304). We subtract DOT11_MGMT_HDR_LEN (24) from "len" so thats's max of 2280. However, the action_frame->data[] buffer is only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy() can overflow. memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN], le16_to_cpu(action_frame->len)); Cc: stable@vger.kernel.org # 3.9.x Fixes: 18e2f61db3 ("brcmfmac: P2P action frame tx.") Reported-by: "freenerguo(郭大兴)" <freenerguo@tencent.com> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-07-12 08:29:56 -07:00
..
brcmfmac	brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()	2017-07-12 08:29:56 -07:00
brcmsmac	mac80211: separate encoding/bandwidth from flags	2017-04-28 10:41:45 +02:00
brcmutil	…
include	brcmfmac: add support for 43341 chip	2016-11-29 17:29:25 +02:00
Kconfig	brcmfmac: update BRCMFMAC symbol description	2017-04-05 15:34:33 +03:00
Makefile	…