net: wireless: bcmdhd: fix buffer overrun in private command path
authorInsun Song <insun.song@broadcom.com>
Sun, 29 Jan 2017 10:48:08 +0000 (15:48 +0530)
committerVinayak Pane <vpane@nvidia.com>
Wed, 1 Mar 2017 02:05:23 +0000 (18:05 -0800)
commit1c5c308d70708b5dbbf1a9559b264c3d2d3fe7d1
tree2a48a1e0369d2272fb786d27766d45c184c143eb
parent8a9eb1cb11ee0108d34982795367be80036294dd
net: wireless: bcmdhd: fix buffer overrun in private command path

buffer overrun case found when length parameter manipulated.

1. if input parameter buffer length is less than 4k,
then allocate 4k by default. It help to get enough margin
for output string overwritten.

2. added additional length check not to override user space
allocated buffer size.

bug 1849492

Change-Id: I586ad7aed3fce24264d520f5257e2833d4e57159
Signed-off-by: Insun Song <insun.song@broadcom.com>
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1295708
(cherry picked from commit 1402382883c9f6793630d6abe6f424a354771980)
Reviewed-on: http://git-master/r/1298474
(cherry picked from commit 347ad09ee15929eb3e7b79b82855c6aea74418d3)
Reviewed-on: http://git-master/r/1311414
GVS: Gerrit_Virtual_Submit
Reviewed-by: Srinivas Ramachandran <srinivasra@nvidia.com>
Reviewed-by: Vinayak Pane <vpane@nvidia.com>
drivers/net/wireless/bcmdhd/wl_android.c
drivers/net/wireless/bcmdhd/wl_android.h
drivers/net/wireless/bcmdhd_88/wl_android.c [changed mode: 0644->0755]
drivers/net/wireless/bcmdhd_88/wl_android.h