]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
wifi: brcmfmac: pcie: handle randbuf allocation failure
authorDuoming Zhou <duoming@zju.edu.cn>
Wed, 6 Mar 2024 14:04:37 +0000 (22:04 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 30 May 2024 07:49:03 +0000 (09:49 +0200)
commit7c15eb344b0d4d3468c9b2a7591ad2b859b29b88
tree78046731e3051eaecb477139cbc530e1ef9472f2
parent3ef1480414bcd63baaa4464ab66cf1a592b90bff
wifi: brcmfmac: pcie: handle randbuf allocation failure

[ Upstream commit 316f790ebcf94bdf59f794b7cdea4068dc676d4c ]

The kzalloc() in brcmf_pcie_download_fw_nvram() will return null
if the physical memory has run out. As a result, if we use
get_random_bytes() to generate random bytes in the randbuf, the
null pointer dereference bug will happen.

In order to prevent allocation failure, this patch adds a separate
function using buffer on kernel stack to generate random bytes in
the randbuf, which could prevent the kernel stack from overflow.

Fixes: 91918ce88d9f ("wifi: brcmfmac: pcie: Provide a buffer of random bytes to the device")
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20240306140437.18177-1-duoming@zju.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c