Return-path: Received: from smtp.codeaurora.org ([198.145.29.96]:52628 "EHLO smtp.codeaurora.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750911AbdILFs7 (ORCPT ); Tue, 12 Sep 2017 01:48:59 -0400 From: Kalle Valo To: Arend van Spriel Cc: Kevin Cernekee , franky.lin@broadcom.com, brcm80211-dev-list.pdl@broadcom.com, linux-wireless@vger.kernel.org, mnissler@chromium.org Subject: Re: [PATCH V2 1/3] brcmfmac: Avoid possible out-of-bounds read References: <20170909193020.19061-1-cernekee@chromium.org> Date: Tue, 12 Sep 2017 08:48:54 +0300 In-Reply-To: (Arend van Spriel's message of "Sun, 10 Sep 2017 20:50:35 +0200") Message-ID: <87tw08mpq1.fsf@purkki.adurom.net> (sfid-20170912_074920_026034_1FCF3E80) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Sender: linux-wireless-owner@vger.kernel.org List-ID: Arend van Spriel writes: > On 09-09-17 21:30, Kevin Cernekee wrote: >> In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before >> the length of rxframe is validated. This could lead to uninitialized >> data being accessed (but not printed). Since we already have a >> perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec, >> and ch.chspec is not modified by decchspec(), avoid the extra >> assignment and use ch.chspec in the debug print. >> >> Suggested-by: Mattias Nissler >> Signed-off-by: Kevin Cernekee >> Reviewed-by: Arend van Spriel >> --- >> drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 +-- >> 1 file changed, 1 insertion(+), 2 deletions(-) >> >> >> V1->V2: Clarify changelog re: whether the uninitialized data is printed. > > This patch and the others in this series look fine to me. Should these go to v4.14? -- Kalle Valo