summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/broadcom/brcm80211/brcmfmac
diff options
context:
space:
mode:
authorPan Bian <bianpan2016@163.com>2016-12-03 18:27:37 +0800
committerKalle Valo <kvalo@codeaurora.org>2017-01-19 14:38:43 +0200
commit259010c509b6f28b3b851ae45238cf526f52e185 (patch)
tree30b1734db15cb11a26aebe237e60a947d3f6392b /drivers/net/wireless/broadcom/brcm80211/brcmfmac
parent7f2f61377bcad5e14d7faf38d4d4317c7d984e71 (diff)
libertas: fix improper return value
Function lbs_cmd_802_11_sleep_params() always return 0, even if the call to lbs_cmd_with_response() fails. In this case, the parameter @sp will keep uninitialized. Because the return value is 0, its caller (say lbs_sleepparams_read()) will not detect the error, and will copy the uninitialized stack memory to user sapce, resulting in stack information leak. To avoid the bug, this patch returns variable ret (which takes the return value of lbs_cmd_with_response()) instead of 0. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=188451 Signed-off-by: Pan Bian <bianpan2016@163.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/broadcom/brcm80211/brcmfmac')
0 files changed, 0 insertions, 0 deletions