Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx> writes: > On 09-09-17 21:30, Kevin Cernekee wrote: >> In brcmf_p2p_notify_rx_mgmt_p2p_probereq(), chanspec is assigned before >> the length of rxframe is validated. This could lead to uninitialized >> data being accessed (but not printed). Since we already have a >> perfectly good endian-swapped copy of rxframe->chanspec in ch.chspec, >> and ch.chspec is not modified by decchspec(), avoid the extra >> assignment and use ch.chspec in the debug print. >> >> Suggested-by: Mattias Nissler <mnissler@xxxxxxxxxxxx> >> Signed-off-by: Kevin Cernekee <cernekee@xxxxxxxxxxxx> >> Reviewed-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx> >> --- >> drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 3 +-- >> 1 file changed, 1 insertion(+), 2 deletions(-) >> >> >> V1->V2: Clarify changelog re: whether the uninitialized data is printed. > > This patch and the others in this series look fine to me. Should these go to v4.14? -- Kalle Valo
