Commit 0d61c917 authored by Tim Gardner's avatar Tim Gardner Committed by John W. Linville
Browse files

brcmsmac: avoid 512 byte stack variable

Dynamically allocate the probe response template which
avoids potential stack corruption. Observed with smatch:

drivers/net/wireless/brcm80211/brcmsmac/main.c:7412 brcms_c_bss_update_probe_resp()
 warn: 'prb_resp' puts 512 bytes on stack

Cc: Brett Rudley <>
Cc: Arend van Spriel <>
Cc: "Franky (Zhenhui) Lin" <>
Cc: Hante Meuleman <>
Cc: "John W. Linville" <>
Cc: Seth Forshee <>
Cc: Pieter-Paul Giesberts <>
Cc: Hauke Mehrtens <>
Signed-off-by: default avatarTim Gardner <>
Acked-by: default avatarArend van Spriel <>
Signed-off-by: default avatarJohn W. Linville <>
parent 708eb54f
...@@ -7405,9 +7405,13 @@ brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc, ...@@ -7405,9 +7405,13 @@ brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
struct brcms_bss_cfg *cfg, struct brcms_bss_cfg *cfg,
bool suspend) bool suspend)
{ {
u16 prb_resp[BCN_TMPL_LEN / 2]; u16 *prb_resp;
int len = BCN_TMPL_LEN; int len = BCN_TMPL_LEN;
prb_resp = kmalloc(BCN_TMPL_LEN, GFP_ATOMIC);
if (!prb_resp)
/* /*
* write the probe response to hardware, or save in * write the probe response to hardware, or save in
* the config structure * the config structure
...@@ -7441,6 +7445,8 @@ brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc, ...@@ -7441,6 +7445,8 @@ brcms_c_bss_update_probe_resp(struct brcms_c_info *wlc,
if (suspend) if (suspend)
brcms_c_enable_mac(wlc); brcms_c_enable_mac(wlc);
} }
void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend) void brcms_c_update_probe_resp(struct brcms_c_info *wlc, bool suspend)
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment