• Daniel Drake's avatar
    mwifiex: fix memory corruption when unsetting multicast list · 6390d885
    Daniel Drake authored
    When trying to unset a previously-set multicast list (i.e. the new list
    has 0 entries), mwifiex_set_multicast_list() was calling down to
    mwifiex_request_set_multicast_list() while leaving
    mcast_list.num_multicast_addr as an uninitialized value.
    
    We were arriving at mwifiex_cmd_mac_multicast_adr() which would then
    proceed to do an often huge memcpy of
    mcast_list.num_multicast_addr*ETH_ALEN bytes, causing memory corruption
    and hard to debug crashes.
    
    Fix this by setting mcast_list.num_multicast_addr to 0 when no multicast
    list is provided. Similarly, fix up the logic in
    mwifiex_request_set_multicast_list() to unset the multicast list that
    was previously sent to the hardware in such cases.
    Signed-off-by: default avatarDaniel Drake <dsd@laptop.org>
    Acked-by: default avatarBing Zhao <bzhao@marvell.com>
    Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
    6390d885
main.c 27.5 KB