Unverified Commit 84951421 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!6567 CVE-2024-26896 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yongqiang Liu <liuyongqiang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/NEGUKI7N5UZOO6DOX3SDY47XDSJJV4JQ/ 
Jérôme Pouiller (1):
  wifi: wfx: fix memory leak when starting AP


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9HKBX 
 
Link:https://gitee.com/openeuler/kernel/pulls/6567

 

Reviewed-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents b327775b c4d7b4ce

drivers/staging/wfx/sta.c

+11 −5
Original line number Diff line number Diff line
@@ -348,6 +348,7 @@ static int wfx_set_mfp_ap(struct wfx_vif *wvif) 
	const int pairwise_cipher_suite_count_offset = 8 / sizeof(u16);

	const int pairwise_cipher_suite_size = 4 / sizeof(u16);

	const int akm_suite_size = 4 / sizeof(u16);

	int ret = -EINVAL;

	const u16 *ptr;



	if (unlikely(!skb))
@@ -356,21 +357,26 @@ static int wfx_set_mfp_ap(struct wfx_vif *wvif) 
	ptr = (u16 *)cfg80211_find_ie(WLAN_EID_RSN, skb->data + ieoffset,

				      skb->len - ieoffset);

	if (unlikely(!ptr))

		return -EINVAL;

		goto free_skb;



	ptr += pairwise_cipher_suite_count_offset;

	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))

		return -EINVAL;

		goto free_skb;



	ptr += 1 + pairwise_cipher_suite_size * *ptr;

	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))

		return -EINVAL;

		goto free_skb;



	ptr += 1 + akm_suite_size * *ptr;

	if (WARN_ON(ptr > (u16 *)skb_tail_pointer(skb)))

		return -EINVAL;

		goto free_skb;



	hif_set_mfp(wvif, *ptr & BIT(7), *ptr & BIT(6));

	return 0;

	ret = 0;



free_skb:

	dev_kfree_skb(skb);

	return ret;

}



int wfx_start_ap(struct ieee80211_hw *hw, struct ieee80211_vif *vif)