mwifiex: fix memory corruption when unsetting multicast list
authorDaniel Drake <dsd@laptop.org>
Fri, 14 Jun 2013 19:24:24 +0000 (15:24 -0400)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 13 Oct 2013 23:08:28 +0000 (16:08 -0700)
commit9e65b308202a4e6536c5b453d6b37fd0467dd5d2
treeea0855b1c39122eb6dc06ae502cda31e982366d9
parentcac65253a9c5a30d4c8d7bc4c60197935f9e2e70
mwifiex: fix memory corruption when unsetting multicast list

commit 6390d88529835a8ad3563fe01a5da89fa52d6db2 upstream.

When trying to unset a previously-set multicast list (i.e. the new list
has 0 entries), mwifiex_set_multicast_list() was calling down to
mwifiex_request_set_multicast_list() while leaving
mcast_list.num_multicast_addr as an uninitialized value.

We were arriving at mwifiex_cmd_mac_multicast_adr() which would then
proceed to do an often huge memcpy of
mcast_list.num_multicast_addr*ETH_ALEN bytes, causing memory corruption
and hard to debug crashes.

Fix this by setting mcast_list.num_multicast_addr to 0 when no multicast
list is provided. Similarly, fix up the logic in
mwifiex_request_set_multicast_list() to unset the multicast list that
was previously sent to the hardware in such cases.

Signed-off-by: Daniel Drake <dsd@laptop.org>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/wireless/mwifiex/main.c
drivers/net/wireless/mwifiex/sta_ioctl.c