From 024b9278c4e99124b29e0f6bbc413447297508b3 Mon Sep 17 00:00:00 2001 From: Ramesh Rangavittal Date: Fri, 3 Feb 2023 00:35:51 -0600 Subject: [PATCH 142/296] brcmfmac: Add NULL checks to fix multiple NULL pointer dereferences Fixes: SWLINUX-3196 Signed-off-by: Ramesh Rangavittal --- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 26 +++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index a0a1c4f53e1a..055b8e1e5a2c 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -3799,7 +3799,13 @@ static s32 brcmf_inform_single_bss(struct brcmf_cfg80211_info *cfg, channel = bi->ctl_ch; band = BRCMU_CHAN_BAND_TO_NL80211(ch.band); freq = ieee80211_channel_to_frequency(channel, band); + if (!freq) + return -EINVAL; + bss_data.chan = ieee80211_get_channel(wiphy, freq); + if (!bss_data.chan) + return -EINVAL; + bss_data.scan_width = NL80211_BSS_CHAN_WIDTH_20; bss_data.boottime_ns = ktime_to_ns(ktime_get_boottime()); @@ -3913,8 +3919,16 @@ static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg, band = wiphy->bands[BRCMU_CHAN_BAND_TO_NL80211(ch.band)]; freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band); + if (!freq) { + err = -EINVAL; + goto cleanup; + } cfg->channel = freq; notify_channel = ieee80211_get_channel(wiphy, freq); + if (!notify_channel) { + err = -EINVAL; + goto cleanup; + } notify_capability = le16_to_cpu(bi->capability); notify_interval = le16_to_cpu(bi->beacon_period); @@ -3935,12 +3949,12 @@ static s32 brcmf_inform_ibss(struct brcmf_cfg80211_info *cfg, if (!bss) { err = -ENOMEM; - goto CleanUp; + goto cleanup; } cfg80211_put_bss(wiphy, bss); -CleanUp: +cleanup: kfree(buf); @@ -6542,7 +6556,11 @@ static int brcmf_cfg80211_get_channel(struct wiphy *wiphy, } freq = ieee80211_channel_to_frequency(ch.control_ch_num, band); + if (!freq) + return -EINVAL; chandef->chan = ieee80211_get_channel(wiphy, freq); + if (!chandef->chan) + return -EINVAL; chandef->width = width; chandef->center_freq1 = ieee80211_channel_to_frequency(ch.chnum, band); chandef->center_freq2 = 0; @@ -7445,7 +7463,11 @@ brcmf_bss_roaming_done(struct brcmf_cfg80211_info *cfg, band = wiphy->bands[BRCMU_CHAN_BAND_TO_NL80211(ch.band)]; freq = ieee80211_channel_to_frequency(ch.control_ch_num, band->band); + if (!freq) + err = -EINVAL; notify_channel = ieee80211_get_channel(wiphy, freq); + if (!notify_channel) + err = -EINVAL; done: kfree(buf); -- 2.25.1