Re: [PATCH] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()

[Johannes Berg <johannes@sipsolutions.net>]

On Fri, 2017-07-07 at 13:01 +0100, Arend van Spriel wrote:
> The lower level nl80211 code in cfg80211 ensures that "len" is
> between
> 25 and NL80211_ATTR_FRAME (2304).  We subtract DOT11_MGMT_HDR_LEN
> (24) from
> "len" so thats's max of 2280.  However, the action_frame->data[]
> buffer is
> only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy()
> can
> overflow.
> 
> 	memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
> 	       le16_to_cpu(action_frame->len));

Kalle is on vacation for the next 10 days or so.

Linus, since you were involved already, will you apply this directly?

Arend, otherwise please resend including netdev@, so we can ask davem
to pick it up (needs to land in his patchwork).

I guess it should also have a Cc: stable tag, and perhaps a Fixes?

Thanks,
johannes