diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-07-31 09:52:18 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-07-31 09:52:17 -0700 |
| commit | 03f28c162d00d96731e730e0f171c3f0e182c44d (patch) | |
| tree | f2336f389e38d1c74f5e57b2c63031e52ec8d6cb | |
| parent | 2552d0a83453a45a5491ca4a4172b9cfe00c0311 (diff) | |
| parent | 1b3f613621764b2b66259852a448924c2e1d6773 (diff) | |
Merge "wil6210: protect against invalid length of tx management frame"
| -rw-r--r-- | drivers/net/wireless/ath/wil6210/cfg80211.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c index 63bb7686b811..94861020af12 100644 --- a/drivers/net/wireless/ath/wil6210/cfg80211.c +++ b/drivers/net/wireless/ath/wil6210/cfg80211.c @@ -960,7 +960,7 @@ int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, wil_hex_dump_misc("mgmt tx frame ", DUMP_PREFIX_OFFSET, 16, 1, buf, len, true); - if (len < sizeof(struct ieee80211_mgmt)) + if (len < sizeof(struct ieee80211_hdr_3addr)) return -EINVAL; cmd = kmalloc(sizeof(*cmd) + len, GFP_KERNEL); |