brcmfmac: fix clearing entry IPv6 address

When IPv6 address is to be cleared there is a possible out of
bound access. But also the clearing of the last entry and the
adjustment of total number of stored IPv6 addresses is not
updated. This patch fixes that bug. Bug was found using coverity.

Reviewed-by: Arend Van Spriel <arend.vanspriel@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Signed-off-by: Hante Meuleman <hante.meuleman@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
index 9a05371453cef7ccd799f33533d09868d0a22f9f..7a65f9da048aca2cedc1c6dc2144971fc499d72c 100644 (file)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
@@ -873,9 +873,12 @@ static int brcmf_inet6addr_changed(struct notifier_block *nb,
                }
                break;
        case NETDEV_DOWN:
-               if (i < NDOL_MAX_ENTRIES)
-                       for (; i < ifp->ipv6addr_idx; i++)
+               if (i < NDOL_MAX_ENTRIES) {
+                       for (; i < ifp->ipv6addr_idx - 1; i++)
                                table[i] = table[i + 1];
+                       memset(&table[i], 0, sizeof(table[i]));
+                       ifp->ipv6addr_idx--;
+               }
                break;
        default:
                break;