[PATCH V3 1/3] brcmfmac: Avoid possible out-of-bounds read

not modified by decchspec(), avoid the extra assignment and use ch.chspec in the debug print. Suggested-by: Mattias Nissler Signed-off-by: Kevin Cernekee Reviewed-by: Arend van Spriel --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 +-- 1 file changed, 1 insertion(+), 2 deleti

[PATCH V3 3/3] brcmfmac: Add check for short event packets

additional data, to avoid copying uninitialized memory into event->data. Suggested-by: Mattias Nissler Signed-off-by: Kevin Cernekee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) V2->V3: Change '<' to '&g

[PATCH V3 2/3] brcmfmac: Delete redundant length check

nd van Spriel Signed-off-by: Kevin Cernekee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 - 1 file changed, 5 deletions(-) V2->V3: No change diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwe

Re: [PATCH 3/3] brcmfmac: Add check for short event packets

On Mon, Sep 11, 2017 at 12:09 PM, Arend van Spriel wrote: >>> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c >>> b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c >>> index 5aabdc9ed7e0..4cad1f0d2a82 100644 >>> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fw

[PATCH V2 2/3] brcmfmac: Delete redundant length check

nd van Spriel Signed-off-by: Kevin Cernekee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 - 1 file changed, 5 deletions(-) V1->V2: Delete the check instead of moving it. diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/

[PATCH V2 1/3] brcmfmac: Avoid possible out-of-bounds read

not modified by decchspec(), avoid the extra assignment and use ch.chspec in the debug print. Suggested-by: Mattias Nissler Signed-off-by: Kevin Cernekee Reviewed-by: Arend van Spriel --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 +-- 1 file changed, 1 insertion(+), 2 deleti

[PATCH V2 3/3] brcmfmac: Add check for short event packets

additional data, to avoid copying uninitialized memory into event->data. Suggested-by: Mattias Nissler Signed-off-by: Kevin Cernekee Reviewed-by: Arend van Spriel --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) V1->V2: No

[PATCH 2/3] brcmfmac: Don't print out-of-bounds event data

Nissler Signed-off-by: Kevin Cernekee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 10 +- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c index

[PATCH 1/3] brcmfmac: Avoid possible out-of-bounds read

not modified by decchspec(), avoid the extra assignment and use ch.chspec in the debug print. Suggested-by: Mattias Nissler Signed-off-by: Kevin Cernekee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/

[PATCH 3/3] brcmfmac: Add check for short event packets

additional data, to avoid copying uninitialized memory into event->data. Suggested-by: Mattias Nissler Signed-off-by: Kevin Cernekee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broad

[PATCH 0/3] New brcmfmac bounds checks

These were suggested by the Chrome OS security team[1]. Compile-tested only. [1] http://crosreview.com/656260 Kevin Cernekee (3): brcmfmac: Avoid possible out-of-bounds read brcmfmac: Don't print out-of-bounds event data brcmfmac: Add check for short event packets drivers/net/wir