diff options
| -rw-r--r-- | wmi/src/wmi_unified_tlv.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 6ce7e3f2f2e9..988f55c7985f 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2016-2019 The Linux Foundation. All rights reserved. + * Copyright (c) 2016-2020 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -9596,6 +9596,14 @@ QDF_STATUS send_stats_ext_req_cmd_tlv(wmi_unified_t wmi_handle, wmi_buf_t buf; size_t len; uint8_t *buf_ptr; + uint16_t max_wmi_msg_size = wmi_get_max_msg_len(wmi_handle); + + if (preq->request_data_len > (max_wmi_msg_size - WMI_TLV_HDR_SIZE - + sizeof(*cmd))) { + WMI_LOGE("%s: Data length=%d is greater than max wmi msg size", + __func__, preq->request_data_len); + return QDF_STATUS_E_FAILURE; + } len = sizeof(*cmd) + WMI_TLV_HDR_SIZE + preq->request_data_len; |