diff options
| author | Thomas Gleixner <tglx@linutronix.de> | 2015-04-08 21:26:21 (GMT) |
|---|---|---|
| committer | Thomas Gleixner <tglx@linutronix.de> | 2015-04-08 21:26:21 (GMT) |
| commit | 462b69b1e43ceccab68a47d65b1e46520cd0fdc0 (patch) | |
| tree | 3c961fcb5889c5ab14ab36d8ef7421fc96c95959 /drivers/net/wireless/brcm80211/brcmfmac/vendor.c | |
| parent | d8bf368d0631d4bc2612d8bf2e4e8e74e620d0cc (diff) | |
| parent | f22e6e847115abc3a0e2ad7bb18d243d42275af1 (diff) | |
| download | linux-462b69b1e43ceccab68a47d65b1e46520cd0fdc0.tar.xz | |
Merge branch 'linus' into irq/core to get the GIC updates which
conflict with pending GIC changes.
Conflicts:
drivers/usb/isp1760/isp1760-core.c
Diffstat (limited to 'drivers/net/wireless/brcm80211/brcmfmac/vendor.c')
| -rw-r--r-- | drivers/net/wireless/brcm80211/brcmfmac/vendor.c | 15 |
1 files changed, 12 insertions, 3 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c index 50cdf70..8eff275 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c @@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy, void *dcmd_buf = NULL, *wr_pointer; u16 msglen, maxmsglen = PAGE_SIZE - 0x100; - brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set, - cmdhdr->len); + if (len < sizeof(*cmdhdr)) { + brcmf_err("vendor command too short: %d\n", len); + return -EINVAL; + } vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev); ifp = vif->ifp; - len -= sizeof(struct brcmf_vndr_dcmd_hdr); + brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd); + + if (cmdhdr->offset > len) { + brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len); + return -EINVAL; + } + + len -= cmdhdr->offset; ret_len = cmdhdr->len; if (ret_len > 0 || len > 0) { if (len > BRCMF_DCMD_MAXLEN) { |