~hc/RK356X_SDK_RELEASE.git

..	..	@@ -90,6 +90,9 @@
90	90	#define BRCMF_ASSOC_PARAMS_FIXED_SIZE \
91	91	(sizeof(struct brcmf_assoc_params_le) - sizeof(u16))
92	92
	93	+#define BRCMF_MAX_CHANSPEC_LIST \
	94	+ (BRCMF_DCMD_MEDLEN / sizeof(__le32) - 1)
	95	+
93	96	static bool check_vif_up(struct brcmf_cfg80211_vif *vif)
94	97	{
95	98	if (!test_bit(BRCMF_VIF_STATUS_READY, &vif->sme_state)) {
..	..	@@ -1347,13 +1350,14 @@
1347	1350	{
1348	1351	struct brcmf_pub *drvr = ifp->drvr;
1349	1352	struct brcmf_wsec_pmk_le pmk;
1350		- int i, err;
	1353	+ int err;
1351	1354
1352		- /* convert to firmware key format */
1353		- pmk.key_len = cpu_to_le16(pmk_len << 1);
1354		- pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE);
1355		- for (i = 0; i < pmk_len; i++)
1356		- snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]);
	1355	+ memset(&pmk, 0, sizeof(pmk));
	1356	+
	1357	+ /* pass pmk directly */
	1358	+ pmk.key_len = cpu_to_le16(pmk_len);
	1359	+ pmk.flags = cpu_to_le16(0);
	1360	+ memcpy(pmk.key, pmk_data, pmk_len);
1357	1361
1358	1362	/* store psk in firmware */
1359	1363	err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK,
..	..	@@ -5831,6 +5835,11 @@
5831	5835	(struct brcmf_cfg80211_assoc_ielen_le *)cfg->extra_buf;
5832	5836	req_len = le32_to_cpu(assoc_info->req_len);
5833	5837	resp_len = le32_to_cpu(assoc_info->resp_len);
	5838	+ if (req_len > WL_EXTRA_BUF_MAX \|\| resp_len > WL_EXTRA_BUF_MAX) {
	5839	+ bphy_err(drvr, "invalid lengths in assoc info: req %u resp %u\n",
	5840	+ req_len, resp_len);
	5841	+ return -EINVAL;
	5842	+ }
5834	5843	if (req_len) {
5835	5844	err = brcmf_fil_iovar_data_get(ifp, "assoc_req_ies",
5836	5845	cfg->extra_buf,
..	..	@@ -6459,6 +6468,13 @@
6459	6468	band->channels[i].flags = IEEE80211_CHAN_DISABLED;
6460	6469
6461	6470	total = le32_to_cpu(list->count);
	6471	+ if (total > BRCMF_MAX_CHANSPEC_LIST) {
	6472	+ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
	6473	+ total);
	6474	+ err = -EINVAL;
	6475	+ goto fail_pbuf;
	6476	+ }
	6477	+
6462	6478	for (i = 0; i < total; i++) {
6463	6479	ch.chspec = (u16)le32_to_cpu(list->element[i]);
6464	6480	cfg->d11inf.decchspec(&ch);
..	..	@@ -6604,6 +6620,13 @@
6604	6620	band = cfg_to_wiphy(cfg)->bands[NL80211_BAND_2GHZ];
6605	6621	list = (struct brcmf_chanspec_list *)pbuf;
6606	6622	num_chan = le32_to_cpu(list->count);
	6623	+ if (num_chan > BRCMF_MAX_CHANSPEC_LIST) {
	6624	+ bphy_err(drvr, "Invalid count of channel Spec. (%u)\n",
	6625	+ num_chan);
	6626	+ kfree(pbuf);
	6627	+ return -EINVAL;
	6628	+ }
	6629	+
6607	6630	for (i = 0; i < num_chan; i++) {
6608	6631	ch.chspec = (u16)le32_to_cpu(list->element[i]);
6609	6632	cfg->d11inf.decchspec(&ch);