Received-SPF: pass (google.com: domain of linux-wireless+bounces-4399-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Content-Type: text/plain; charset="utf-8"
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PATCH v3] wifi: brcm80211: handle pmk_op allocation failure
From: Kalle Valo <kvalo@kernel.org>
In-Reply-To: <20240229103153.18533-1-duoming@zju.edu.cn>
References: <20240229103153.18533-1-duoming@zju.edu.cn>
To: Duoming Zhou <duoming@zju.edu.cn>
Cc: linux-kernel@vger.kernel.org, brcm80211-dev-list.pdl@broadcom.com,
 brcm80211@lists.linux.dev, linux-wireless@vger.kernel.org,
 justinstitt@google.com, quic_alokad@quicinc.com, jisoo.jang@yonsei.ac.kr,
 petr.tesarik.ext@huawei.com, hdegoede@redhat.com, keescook@chromium.org,
 johannes.berg@intel.com, arend.vanspriel@broadcom.com,
 Duoming Zhou <duoming@zju.edu.cn>
User-Agent: pwcli/0.1.1-git (https://github.com/kvalo/pwcli/) Python/3.11.2
Message-ID: <170966497987.424347.4050351610859400431.kvalo@kernel.org>
Date: Tue,  5 Mar 2024 18:56:21 +0000 (UTC)

Duoming Zhou <duoming@zju.edu.cn> wrote:

> The kzalloc() in brcmf_pmksa_v3_op() will return null if the
> physical memory has run out. As a result, if we dereference
> the null value, the null pointer dereference bug will happen.
> 
> Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails
> for pmk_op.
> 
> Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations")
> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
> Reviewed-by: Kees Cook <keescook@chromium.org>

Patch applied to wireless-next.git, thanks.

b4152222e04c wifi: brcm80211: handle pmk_op allocation failure

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20240229103153.18533-1-duoming@zju.edu.cn/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches