From: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>
Date: Wed, 12 Jul 2017 13:49:23 +0200
> On 7/7/2017 10:09 PM, Arend van Spriel wrote:
>> The lower level nl80211 code in cfg80211 ensures that "len" is between
>> 25 and NL80211_ATTR_FRAME (2304). We subtract DOT11_MGMT_HDR_LEN (24)
>> from
>> "len" so thats's max of 2280. However, the action_frame->data[]
>> buffer is
>> only BRCMF_FIL_ACTION_FRAME_SIZE (1800) bytes long so this memcpy()
>> can
>> overflow.
>>
>> memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
>> le16_to_cpu(action_frame->len));
>>
>> Cc: stable@xxxxxxxxxxxxxxx # 3.9.x
>> Fixes: 18e2f61db3b70 ("brcmfmac: P2P action frame tx.")
>> Reported-by: "freenerguo(郭大兴)" <freenerguo@xxxxxxxxxxx>
>> Signed-off-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>
>> ---
>> V2:
>> - added Fixes: tag and Cc: for stable kernels.
>> - Cc: patch to netdev list.
>> ---
>> Hi David,
>>
>> Here is the patch as Linus send it to us and security@xxxxxxxxxx. I
>> removed the lower bound check as that is already done in cfg80211.
>> Now I signed off on the patch although formally I suppose Linus should
>> sign it off. Putting it out there so people can respond as deemed
>> necessary.
>>
>> The reason for submitting it to your tree is the fact that Kalle is
>> on vacation for next 10 days or so which was indicated to me by
>> Johannes.
>> The patch applies to the master branch of your net repository. For
>> reference V1 of this patch can be found here [1].
>
> Hi Dave,
>
> Not sure if you missed this one. It is addressing a reported security
> issue and intended for the net repository, not net-next which is
> obviously closed [2].
Thanks for pointing this out to me, I'll take care of it.
