On Mon, Jan 31, 2022 at 6:07 PM Hector Martin marcan@marcan.st wrote:

If boardrev is missing from the NVRAM we add a default one, but this might need more space in the output buffer than was allocated. Ensure we have enough padding for this in the buffer.

Reviewed-by: Andy Shevchenko andy.shevchenko@gmail.com

Fixes: 46f2b38a91b0 ("brcmfmac: insert default boardrev in nvram data if missing") Reviewed-by: Arend van Spriel arend.vanspriel@broadcom.com Cc: stable@vger.kernel.org Signed-off-by: Hector Martin marcan@marcan.st

---

drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 2 ++ 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c index 0eb13e5df517..1001c8888bfe 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c @@ -207,6 +207,8 @@ static int brcmf_init_nvram_parser(struct nvram_parser *nvp, size = BRCMF_FW_MAX_NVRAM_SIZE; else size = data_len;

•   /* Add space for properties we may add */
  

•   size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1;
    /* Alloc for extra 0 byte + roundup by 4 + length field */
    size += 1 + 3 + sizeof(u32);
    nvp->nvram = kzalloc(size, GFP_KERNEL);
  

-- 2.33.0