On Thu, Feb 29, 2024 at 06:31:53PM +0800, Duoming Zhou wrote:
> The kzalloc() in brcmf_pmksa_v3_op() will return null if the
> physical memory has run out. As a result, if we dereference
> the null value, the null pointer dereference bug will happen.
>
> Return -ENOMEM from brcmf_pmksa_v3_op() if kzalloc() fails
> for pmk_op.
>
> Fixes: a96202acaea4 ("wifi: brcmfmac: cfg80211: Add support for PMKID_V3 operations")
> Acked-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx>
> Signed-off-by: Duoming Zhou <duoming@xxxxxxxxxx>
Thanks for the respin! :)
Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
--
Kees Cook
