diff options
| author | Linux Build Service Account <lnxbuild@quicinc.com> | 2017-10-07 09:46:47 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-10-07 09:46:46 -0700 |
| commit | 6604cb543eeb8190109e30e6fdbe977466c42aba (patch) | |
| tree | e1d3acd7948a2859f04bff2eac9a33993f7268db | |
| parent | 9dd28a91539ce116f267c1abe116242743c4ffc2 (diff) | |
| parent | 62d33b113c374cf529241c08d72ca1e7a1417b7b (diff) | |
Merge "wil6210: potential buffer overflow in wmi_evt_aoa_meas"
| -rw-r--r-- | drivers/net/wireless/ath/wil6210/ftm.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/wil6210/ftm.c b/drivers/net/wireless/ath/wil6210/ftm.c index d856e091a5de..5906b90b337d 100644 --- a/drivers/net/wireless/ath/wil6210/ftm.c +++ b/drivers/net/wireless/ath/wil6210/ftm.c @@ -685,6 +685,10 @@ void wil_aoa_evt_meas(struct wil6210_priv *wil, int data_len = len - offsetof(struct wmi_aoa_meas_event, meas_data); struct wil_aoa_meas_result *res; + if (data_len < 0) { + wil_err(wil, "AOA event too short (%d)\n", len); + return; + } data_len = min_t(int, le16_to_cpu(evt->length), data_len); res = kmalloc(sizeof(*res) + data_len, GFP_KERNEL); |