update kernel to 5.10.198

hc

2024-01-03 2f7c68cb55ecb7331f2381deb497c27155f32faf

 kernel/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
..
..
@@ -90,6 +90,9 @@
90
90
 #define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
91
91
 	(sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
92
92
 
93
+#define BRCMF_MAX_CHANSPEC_LIST \
94
+	(BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
95
+
93
96
 static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
94
97
 {
95
98
 	if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
..
..
@@ -1347,13 +1350,14 @@
1347
1350
 {
1348
1351
 	struct brcmf_pub *drvr = ifp->drvr;
1349
1352
 	struct brcmf_wsec_pmk_le pmk;
1350
-	int i, err;
1353
+	int err;
1351
1354
 
1352
-	/* convert to firmware key format */
1353
-	pmk.key_len = cpu_to_le16(pmk_len << 1);
1354
-	pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE);
1355
-	for (i = 0; i < pmk_len; i++)
1356
-		snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]);
1355
+	memset(&pmk, 0, sizeof(pmk));
1356
+
1357
+	/* pass pmk directly */
1358
+	pmk.key_len = cpu_to_le16(pmk_len);
1359
+	pmk.flags = cpu_to_le16(0);
1360
+	memcpy(pmk.key, pmk_data, pmk_len);
1357
1361
 
1358
1362
 	/* store psk in firmware */
1359
1363
 	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
..
..
@@ -5831,6 +5835,11 @@
5831
5835
 		(struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5832
5836
 	req_len = le32_to_cpu(assoc_info->req_len);
5833
5837
 	resp_len = le32_to_cpu(assoc_info->resp_len);
5838
+	if (req_len > WL_EXTRA_BUF_MAX || resp_len > WL_EXTRA_BUF_MAX) {
5839
+		bphy_err(drvr, "invalid lengths in assoc info: req %u resp %u\n",
5840
+			 req_len, resp_len);
5841
+		return -EINVAL;
5842
+	}
5834
5843
 	if (req_len) {
5835
5844
 		err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5836
5845
 					       cfg->extra_buf,
..
..
@@ -6459,6 +6468,13 @@
6459
6468
 			band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6460
6469
 
6461
6470
 	total = le32_to_cpu(list->count);
6471
+	if (total > BRCMF_MAX_CHANSPEC_LIST) {
6472
+		bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
6473
+			 total);
6474
+		err = -EINVAL;
6475
+		goto fail_pbuf;
6476
+	}
6477
+
6462
6478
 	for (i = 0; i < total; i++) {
6463
6479
 		ch.chspec = (u16)le32_to_cpu(list->element[i]);
6464
6480
 		cfg->d11inf.decchspec(&ch);
..
..
@@ -6604,6 +6620,13 @@
6604
6620
 		band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6605
6621
 		list = (struct brcmf_chanspec_list *)pbuf;
6606
6622
 		num_chan = le32_to_cpu(list->count);
6623
+		if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
6624
+			bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
6625
+				 num_chan);
6626
+			kfree(pbuf);
6627
+			return -EINVAL;
6628
+		}
6629
+
6607
6630
 		for (i = 0; i < num_chan; i++) {
6608
6631
 			ch.chspec = (u16)le32_to_cpu(list->element[i]);
6609
6632
 			cfg->d11inf.decchspec(&ch);