Re: brcmfmac: driver crash with iOS 18.6.1, potential DoS

On 9/29/2025 7:06 PM, Stefan Wahren wrote:
> Hi,
> regarding reproducibility, I would assume Arend is using the mainline 
> kernel and Hsien just tested the Raspberry Pi vendor kernel. The 
> brcmfmac driver has some modifications downstream.

Actually, I tried to build the downstream RPi vendor kernel. However, 
there are some variables in play. The config Hsien Chou sent was 6.6.28, 
but the log is 6.12.34. So I have taken the provided config and built 
from the rpi-6.6.y branch:

commit bba53a117a4a5c29da892962332ff1605990e17a (HEAD, rpi/rpi-6.6.y)
Author: Phil Elwell <[email protected]>
Date:   Wed Mar 26 11:28:28 2025 +0000

     dts: rp1: Don't use DMA with UARTs

     DMA has been enabled on RP1's UART0, but with mixed success. Transmits
     seem to work, but the DMA interface is not well suited to receiving
     arbitrary amounts of data. In particular, the PL011 driver is slow to
     pass on the received data, batching it into large blocks.

     On balance, it's better to just disable the DMA support. As with the
     other UARTs, the required runes are left in the DTS as comments.

     Signed-off-by: Phil Elwell <[email protected]>

Probably should have tried withthe rpui-6.12.y branch instead. Let me 
try that although...:

$ git diff rpi/rpi-6.6.y rpi/rpi-6.12.y -- 
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c 
b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
index 7376f9f37d07..7949f78c61e1 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -2339,7 +2339,7 @@ struct wireless_dev *brcmf_p2p_add_vif(struct 
wiphy *wiphy, const char *name,
                 goto fail;
         }

-       strncpy(ifp->ndev->name, name, sizeof(ifp->ndev->name) - 1);
+       strscpy(ifp->ndev->name, name, sizeof(ifp->ndev->name));
         ifp->ndev->name_assign_type = name_assign_type;
         err = brcmf_net_attach(ifp, true);
         if (err) {

Gr. AvS

> @Hsien or @Chris,
> are you able to reproduce it with a mainline/torvalds kernel?
> You only need to replace Kernel, Modules and Device tree.
> 
> Best regards
>