diff options
| author | Dmitry Antipov <dmantipov@yandex.ru> | 2023-08-14 12:49:57 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-09-23 10:46:55 +0200 |
| commit | d155c5f64cefacdc6a9a26d40be53ee2903c28ff (patch) | |
| tree | 143e5ac699a3a1282b6767c7a4c6c8356aedc93a /drivers/net/wireless | |
| parent | 531cb8c9c1132d10ae488354cb85dc8eaf9ba89c (diff) | |
| download | linux-stable-d155c5f64cefacdc6a9a26d40be53ee2903c28ff.tar.gz linux-stable-d155c5f64cefacdc6a9a26d40be53ee2903c28ff.tar.bz2 linux-stable-d155c5f64cefacdc6a9a26d40be53ee2903c28ff.zip | |
wifi: mwifiex: avoid possible NULL skb pointer dereference
[ Upstream commit 35a7a1ce7c7d61664ee54f5239a1f120ab95a87e ]
In 'mwifiex_handle_uap_rx_forward()', always check the value
returned by 'skb_copy()' to avoid potential NULL pointer
dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop
original skb in case of copying failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 838e4f449297 ("mwifiex: improve uAP RX handling")
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/net/wireless')
| -rw-r--r-- | drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c index 90c07722c25f..a887d7a9b7c0 100644 --- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c +++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c @@ -266,7 +266,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv, if (is_multicast_ether_addr(ra)) { skb_uap = skb_copy(skb, GFP_ATOMIC); - mwifiex_uap_queue_bridged_pkt(priv, skb_uap); + if (likely(skb_uap)) { + mwifiex_uap_queue_bridged_pkt(priv, skb_uap); + } else { + mwifiex_dbg(adapter, ERROR, + "failed to copy skb for uAP\n"); + priv->stats.rx_dropped++; + dev_kfree_skb_any(skb); + return -1; + } } else { if (mwifiex_get_sta_entry(priv, ra)) { /* Requeue Intra-BSS packet */ |