evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "wil6210: protect against invalid length of tx management frame"

Browse source
This commit is contained in:
Linux Build Service Account 2017-06-22 07:40:22 -07:00 • committed by Gerrit - the friendly Code Review server
commit a367cb43e4
2 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/net/wireless/ath/wil6210/cfg80211.c
View file

@ -960,6 +960,9 @@ int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
wil_hex_dump_misc("mgmt tx frame ", DUMP_PREFIX_OFFSET, 16, 1, buf, wil_hex_dump_misc("mgmt tx frame ", DUMP_PREFIX_OFFSET, 16, 1, buf,
len, true); len, true);
if (len < sizeof(struct ieee80211_mgmt))
return -EINVAL;
cmd = kmalloc(sizeof(*cmd) + len, GFP_KERNEL); cmd = kmalloc(sizeof(*cmd) + len, GFP_KERNEL);
if (!cmd) { if (!cmd) {
rc = -ENOMEM; rc = -ENOMEM;

6
drivers/net/wireless/ath/wil6210/debugfs.c
View file

@ -805,8 +805,12 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf,
struct wireless_dev *wdev = wil_to_wdev(wil); struct wireless_dev *wdev = wil_to_wdev(wil);
struct cfg80211_mgmt_tx_params params; struct cfg80211_mgmt_tx_params params;
int rc; int rc;
void *frame = kmalloc(len, GFP_KERNEL); void *frame;
if (!len)
return -EINVAL;
frame = kmalloc(len, GFP_KERNEL);
if (!frame) if (!frame)
return -ENOMEM; return -ENOMEM;