diff options
| author | Daniel Drake <dsd@laptop.org> | 2013-06-14 15:24:24 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-10-13 19:08:28 -0400 |
| commit | 9e65b308202a4e6536c5b453d6b37fd0467dd5d2 (patch) | |
| tree | ea0855b1c39122eb6dc06ae502cda31e982366d9 /lib | |
| parent | cac65253a9c5a30d4c8d7bc4c60197935f9e2e70 (diff) | |
mwifiex: fix memory corruption when unsetting multicast list
commit 6390d88529835a8ad3563fe01a5da89fa52d6db2 upstream.
When trying to unset a previously-set multicast list (i.e. the new list
has 0 entries), mwifiex_set_multicast_list() was calling down to
mwifiex_request_set_multicast_list() while leaving
mcast_list.num_multicast_addr as an uninitialized value.
We were arriving at mwifiex_cmd_mac_multicast_adr() which would then
proceed to do an often huge memcpy of
mcast_list.num_multicast_addr*ETH_ALEN bytes, causing memory corruption
and hard to debug crashes.
Fix this by setting mcast_list.num_multicast_addr to 0 when no multicast
list is provided. Similarly, fix up the logic in
mwifiex_request_set_multicast_list() to unset the multicast list that
was previously sent to the hardware in such cases.
Signed-off-by: Daniel Drake <dsd@laptop.org>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'lib')
0 files changed, 0 insertions, 0 deletions