diff --git a/drivers/net/wireless/bcmdhd/dhd.h b/drivers/net/wireless/bcmdhd/dhd.h
index 7ddde04029a9fd7f349e7591321f185d35e294c7..f2cd8e64612463015a0752757e78f2f01659a69a 100644
--- a/drivers/net/wireless/bcmdhd/dhd.h
+++ b/drivers/net/wireless/bcmdhd/dhd.h
@@ -809,7 +809,7 @@ extern int dhd_ifidx2hostidx(struct dhd_info *dhd, int ifidx);
extern int dhd_net2idx(struct dhd_info *dhd, struct net_device *net);
extern struct net_device * dhd_idx2net(void *pub, int ifidx);
extern int net_os_send_hang_message(struct net_device *dev);
-extern int wl_host_event(dhd_pub_t *dhd_pub, int *idx, void *pktdata,
+extern int wl_host_event(dhd_pub_t *dhd_pub, int *idx, void *pktdata, size_t pktlen,
wl_event_msg_t *, void **data_ptr, void *);
extern void wl_event_to_host_order(wl_event_msg_t * evt);
diff --git a/drivers/net/wireless/bcmdhd/dhd_common.c b/drivers/net/wireless/bcmdhd/dhd_common.c
index 0959db913d355f32c03fea0201130066e6296588..235c4019e4ecea9e481800bac332f18b4e2494bc 100644
--- a/drivers/net/wireless/bcmdhd/dhd_common.c
+++ b/drivers/net/wireless/bcmdhd/dhd_common.c
@@ -107,8 +107,8 @@ extern int dhd_change_mtu(dhd_pub_t *dhd, int new_mtu, int ifidx);
extern int dhd_get_concurrent_capabilites(dhd_pub_t *dhd);
#endif
extern int dhd_socram_dump(struct dhd_bus *bus);
-static void dngl_host_event_process(dhd_pub_t *dhdp, bcm_dngl_event_t *event);
-static int dngl_host_event(dhd_pub_t *dhdp, void *pktdata);
+static void dngl_host_event_process(dhd_pub_t *dhdp, bcm_dngl_event_t *event, size_t pktlen);
+static int dngl_host_event(dhd_pub_t *dhdp, void *pktdata, size_t pktlen);
bool ap_cfg_running = FALSE;
bool ap_fw_loaded = FALSE;
@@ -1377,7 +1377,7 @@ wl_show_host_event(dhd_pub_t *dhd_pub, wl_event_msg_t *event, void *event_data,
/* Check whether packet is a BRCM dngl event pkt. If it is, process event data. */
int
-dngl_host_event(dhd_pub_t *dhdp, void *pktdata)
+dngl_host_event(dhd_pub_t *dhdp, void *pktdata, size_t pktlen)
{
bcm_dngl_event_t *pvt_data = (bcm_dngl_event_t *)pktdata;
@@ -1388,14 +1388,14 @@ dngl_host_event(dhd_pub_t *dhdp, void *pktdata)
/* Check to see if this is a DNGL event */
if (ntoh16_ua((void *)&pvt_data->bcm_hdr.usr_subtype) ==
BCMILCP_BCM_SUBTYPE_DNGLEVENT) {
- dngl_host_event_process(dhdp, pvt_data);
+ dngl_host_event_process(dhdp, pvt_data, pktlen);
return BCME_OK;
}
return BCME_ERROR;
}
void
-dngl_host_event_process(dhd_pub_t *dhdp, bcm_dngl_event_t *event)
+dngl_host_event_process(dhd_pub_t *dhdp, bcm_dngl_event_t *event, size_t pktlen)
{
bcm_dngl_event_msg_t *dngl_event = &event->dngl_event;
uint8 *p = (uint8 *)(event + 1);
@@ -1404,6 +1404,9 @@ dngl_host_event_process(dhd_pub_t *dhdp, bcm_dngl_event_t *event)
uint16 version = ntoh16_ua((void *)&dngl_event->version);
DHD_EVENT(("VERSION:%d, EVENT TYPE:%d, DATALEN:%d\n", version, type, datalen));
+ if (datalen > (pktlen - sizeof(bcm_event_t))) {
+ return;
+ }
if (version != BCM_DNGL_EVENT_MSG_VERSION) {
DHD_ERROR(("%s:version mismatch:%d:%d\n", __FUNCTION__,
version, BCM_DNGL_EVENT_MSG_VERSION));
@@ -1494,7 +1497,7 @@ dngl_host_event_process(dhd_pub_t *dhdp, bcm_dngl_event_t *event)
break;
}
}
-int wl_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata,
+int wl_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata, size_t pktlen,
wl_event_msg_t *event, void **data_ptr, void *raw_event)
{
/* check whether packet is a BRCM event pkt */
@@ -1506,7 +1509,7 @@ int wl_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata,
int hostidx;
/* If it is a DNGL event process it first */
- if (dngl_host_event(dhd_pub, pktdata) == BCME_OK) {
+ if (dngl_host_event(dhd_pub, pktdata, pktlen) == BCME_OK) {
return BCME_OK;
}
@@ -1521,6 +1524,9 @@ int wl_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata,
return (BCME_ERROR);
}
+ if (pktlen < sizeof(bcm_event_t))
+ return (BCME_ERROR);
+
*data_ptr = &pvt_data[1];
event_data = *data_ptr;
@@ -1531,8 +1537,15 @@ int wl_host_event(dhd_pub_t *dhd_pub, int *ifidx, void *pktdata,
type = ntoh32_ua((void *)&event->event_type);
flags = ntoh16_ua((void *)&event->flags);
status = ntoh32_ua((void *)&event->status);
+
datalen = ntoh32_ua((void *)&event->datalen);
+ if (datalen > pktlen)
+ return (BCME_ERROR);
+
evlen = datalen + sizeof(bcm_event_t);
+ if (evlen > pktlen) {
+ return BCME_ERROR;
+ }
/* find equivalent host index for event ifidx */
hostidx = dhd_ifidx2hostidx(dhd_pub->info, event->ifidx);
diff --git a/drivers/net/wireless/bcmdhd/dhd_linux.c b/drivers/net/wireless/bcmdhd/dhd_linux.c
index 9a8a9b896e187ca2269f28400f29112ff85bd430..c2f3e7e79a45924ab1ffcd12ac13c802fed73c34 100644
--- a/drivers/net/wireless/bcmdhd/dhd_linux.c
+++ b/drivers/net/wireless/bcmdhd/dhd_linux.c
@@ -700,7 +700,7 @@ static int dhd_toe_get(dhd_info_t *dhd, int idx, uint32 *toe_ol);
static int dhd_toe_set(dhd_info_t *dhd, int idx, uint32 toe_ol);
#endif /* TOE */
-static int dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata,
+static int dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata, size_t pktlen,
wl_event_msg_t *event_ptr, void **data_ptr);
#ifdef DHD_UNICAST_DHCP
static const uint8 llc_snap_hdr[SNAP_HDR_LEN] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
@@ -3027,6 +3027,7 @@ dhd_rx_frame(dhd_pub_t *dhdp, int ifidx, void *pktbuf, int numpkt, uint8 chan,
#else
skb->mac.raw,
#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 22) */
+ len - 2,
&event,
&data);
@@ -7439,16 +7440,18 @@ dhd_get_wireless_stats(struct net_device *dev)
#endif /* defined(WL_WIRELESS_EXT) */
static int
-dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata,
+dhd_wl_host_event(dhd_info_t *dhd, int *ifidx, void *pktdata, size_t pktlen,
wl_event_msg_t *event, void **data)
{
int bcmerror = 0;
ASSERT(dhd != NULL);
#ifdef SHOW_LOGTRACE
- bcmerror = wl_host_event(&dhd->pub, ifidx, pktdata, event, data, &dhd->event_data);
+ bcmerror = wl_host_event(&dhd->pub, ifidx, pktdata, pktlen,
+ event, data, &dhd->event_data);
#else
- bcmerror = wl_host_event(&dhd->pub, ifidx, pktdata, event, data, NULL);
+ bcmerror = wl_host_event(&dhd->pub, ifidx, pktdata, pktlen,
+ event, data, NULL);
#endif /* SHOW_LOGTRACE */
if (bcmerror != BCME_OK)