Subject: CVE-2024-38575: wifi: brcmfmac: pcie: handle randbuf allocation failure

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: pcie: handle randbuf allocation failure

The kzalloc() in brcmf_pcie_download_fw_nvram() will return null
if the physical memory has run out. As a result, if we use
get_random_bytes() to generate random bytes in the randbuf, the
null pointer dereference bug will happen.

In order to prevent allocation failure, this patch adds a separate
function using buffer on kernel stack to generate random bytes in
the randbuf, which could prevent the kernel stack from overflow.

The Linux kernel CVE team has assigned CVE-2024-38575 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.1.30 with commit c35105f375b5 and fixed in 6.1.93 with commit 0eb2c0528e23
	Issue introduced in 6.4 with commit 91918ce88d9f and fixed in 6.6.33 with commit c37466406f07
	Issue introduced in 6.4 with commit 91918ce88d9f and fixed in 6.8.12 with commit 7c15eb344b0d
	Issue introduced in 6.4 with commit 91918ce88d9f and fixed in 6.9.3 with commit 3729ca9e48d1
	Issue introduced in 6.4 with commit 91918ce88d9f and fixed in 6.10 with commit 316f790ebcf9
	Issue introduced in 6.3.4 with commit ba72baed066f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-38575
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0eb2c0528e232b3c32cde9d5e1c9f80ba2996e49
	https://git.kernel.org/stable/c/c37466406f075476c2702ecc01917928af871f3b
	https://git.kernel.org/stable/c/7c15eb344b0d4d3468c9b2a7591ad2b859b29b88
	https://git.kernel.org/stable/c/3729ca9e48d19a03ae049e2bde510e161c2f3720
	https://git.kernel.org/stable/c/316f790ebcf94bdf59f794b7cdea4068dc676d4c