Received-SPF: pass (google.com: domain of linux-kernel+bounces-87743-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Thu, 29 Feb 2024 16:40:36 -0800
From: Kees Cook <keescook@chromium.org>
To: Duoming Zhou <duoming@zju.edu.cn>
Cc: linux-kernel@vger.kernel.org, brcm80211-dev-list.pdl@broadcom.com,
	brcm80211@lists.linux.dev, linux-wireless@vger.kernel.org,
	justinstitt@google.com, quic_alokad@quicinc.com,
	jisoo.jang@yonsei.ac.kr, petr.tesarik.ext@huawei.com,
	hdegoede@redhat.com, johannes.berg@intel.com, kvalo@kernel.org,
	arend.vanspriel@broadcom.com
Subject: Re: [PATCH v3] wifi: brcm80211: handle pmk_op allocation failure
Message-ID: <202402291640.9AAD719D3@keescook>
References: <20240229103153.18533-1-duoming@zju.edu.cn>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240229103153.18533-1-duoming@zju.edu.cn>

On Thu, Feb 29, 2024 at 06:31:53PM +0800, Duoming Zhou wrote:
> The kzalloc() in brcmf_pmksa_v3_op() will return null if the
> physical memory has run out. As a result, if we dereference
> the null value, the null pointer dereference bug will happen.
> 
> Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails
> for pmk_op.
> 
> Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations")
> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>

Thanks for the respin! :)

Reviewed-by: Kees Cook <keescook@chromium.org>

-- 
Kees Cook