Received-SPF: pass (google.com: domain of linux-wireless+bounces-4626-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Content-Type: text/plain; charset="utf-8"
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Subject: Re: [PATCH v2] wifi: brcmfmac: pcie: handle randbuf allocation
 failure
From: Kalle Valo <kvalo@kernel.org>
In-Reply-To: <20240306140437.18177-1-duoming@zju.edu.cn>
References: <20240306140437.18177-1-duoming@zju.edu.cn>
To: Duoming Zhou <duoming@zju.edu.cn>
Cc: linux-kernel@vger.kernel.org, brcm80211-dev-list.pdl@broadcom.com,
 brcm80211@lists.linux.dev, linux-wireless@vger.kernel.org,
 minipli@grsecurity.net, hdegoede@redhat.com, arend.vanspriel@broadcom.com,
 arnd@arndb.de, Duoming Zhou <duoming@zju.edu.cn>
User-Agent: pwcli/0.1.1-git (https://github.com/kvalo/pwcli/) Python/3.11.2
Message-ID: <171025755133.1969294.16879379450612075833.kvalo@kernel.org>
Date: Tue, 12 Mar 2024 15:32:33 +0000 (UTC)

Duoming Zhou <duoming@zju.edu.cn> wrote:

> The kzalloc() in brcmf_pcie_download_fw_nvram() will return null
> if the physical memory has run out. As a result, if we use
> get_random_bytes() to generate random bytes in the randbuf, the
> null pointer dereference bug will happen.
> 
> In order to prevent allocation failure, this patch adds a separate
> function using buffer on kernel stack to generate random bytes in
> the randbuf, which could prevent the kernel stack from overflow.
> 
> Fixes: 91918ce88d9f ("wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device")
> Suggested-by: Arnd Bergmann <arnd@arndb.de>
> Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>

Patch applied to wireless-next.git, thanks.

316f790ebcf9 wifi: brcmfmac: pcie: handle randbuf allocation failure

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20240306140437.18177-1-duoming@zju.edu.cn/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches