android_kernel_sony_sdm845/drivers/net
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Rafał Miłecki 8ee785016d brcmfmac: avoid writing channel out of allocated array
commit 77c0d0cd10e793989d1e8b835a9a09694182cb39 upstream.

Our code was assigning number of channels to the index variable by
default. If firmware reported channel we didn't predict this would
result in using that initial index value and writing out of array. This
never happened so far (we got a complete list of supported channels) but
it means possible memory corruption so we should handle it anyway.

This patch simply detects unexpected channel and ignores it.

As we don't try to create new entry now, it's also safe to drop hw_value
and center_freq assignment. For known channels we have these set anyway.

I decided to fix this issue by assigning NULL or a target channel to the
channel variable. This was one of possible ways, I prefefred this one as
it also avoids using channel[index] over and over.

Fixes: 58de92d2f9 ("brcmfmac: use static superset of channels for wiphy bands")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2017-07-05 14:40:30 +02:00
..
appletalk
arcnet
bonding bonding: fix accounting of active ports in 3ad 2017-06-07 12:07:45 +02:00
caif
can can: gs_usb: fix memory leak in gs_cmd_reset() 2017-06-24 07:11:12 +02:00
cris
dsa net: dsa: bcm_sf2: Utilize nested MDIO read/write 2017-01-15 13:42:55 +01:00
ethernet ravb: Fix use-after-free on ifconfig eth0 down 2017-07-05 14:40:27 +02:00
fddi
fjes
hamradio NET: mkiss: Fix panic 2017-06-17 06:41:50 +02:00
hippi
hyperv Drivers: hv: vmbus: finally fix hv_need_to_signal_on_read() 2017-02-14 15:25:39 -08:00
ieee802154 ieee802154: atusb: do not use the stack for buffers to make them DMA able 2017-01-26 08:24:38 +01:00
ipvlan driver: ipvlan: Unlink the upper dev when ipvlan_link_new failed 2016-12-08 14:30:07 -05:00
irda net: irda: irda-usb: fix firmware name on big-endian hosts 2017-05-25 15:44:39 +02:00
phy net: phy: dp83867: allow RGMII_TXID/RGMII_RXID interface types 2017-07-05 14:40:27 +02:00
plip
ppp
slip
team
usb r8152: avoid start_xmit to schedule napi when napi is disabled 2017-06-17 06:41:55 +02:00
vmxnet3 vmxnet3: avoid assumption about invalid dma_pa in vmxnet3_set_mc() 2016-10-15 17:47:32 -04:00
wan net: wan: slic_ds26522: Allow driver to built if COMPILE_TEST is enabled 2016-10-14 10:11:49 -04:00
wimax
wireless brcmfmac: avoid writing channel out of allocated array 2017-07-05 14:40:30 +02:00
xen-netback xen-netback: protect resource cleaning on XenBus disconnect 2017-07-05 14:40:21 +02:00
dummy.c
eql.c
geneve.c geneve: lock RCU on TX path 2017-03-22 12:43:32 +01:00
gtp.c gtp: add genl family modules alias 2017-06-17 06:41:54 +02:00
ifb.c
Kconfig ipvlan: Fix dependency issue 2016-09-20 22:55:23 -04:00
LICENSE.SRC
loopback.c net: introduce device min_header_len 2017-02-18 15:11:43 +01:00
macsec.c macsec: dynamically allocate space for sglist 2017-05-14 14:00:20 +02:00
macvlan.c macvlan: Fix device ref leak when purging bc_queue 2017-05-03 08:36:37 -07:00
macvtap.c macvtap: read vnet_hdr_size once 2017-02-18 15:11:42 +01:00
Makefile
mdio.c
mii.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tun.c tun: fix premature POLLOUT notification on tun devices 2017-03-22 12:43:34 +01:00
veth.c
virtio_net.c virtio_net: fix PAGE_SIZE > 64k 2017-07-05 14:40:23 +02:00
vrf.c net: vrf: Make add_fib_rules per network namespace flag 2017-07-05 14:40:14 +02:00
vxlan.c vxlan: do not age static remote mac entries 2017-07-05 14:40:23 +02:00
xen-netfront.c xen-netfront: Fix Rx stall during network stress and OOM 2017-07-05 14:40:22 +02:00