Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8c948a8 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "wil6210: protect against invalid length of tx management frame"

parents 09e337bd 7194ff3c

drivers/net/wireless/ath/wil6210/cfg80211.c

+3 −0
Original line number Diff line number Diff line
@@ -965,6 +965,9 @@ int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, 
	wil_hex_dump_misc("mgmt tx frame ", DUMP_PREFIX_OFFSET, 16, 1, buf,

			  len, true);



	if (len < sizeof(struct ieee80211_hdr_3addr))

		return -EINVAL;



	cmd = kmalloc(sizeof(*cmd) + len, GFP_KERNEL);

	if (!cmd) {

		rc = -ENOMEM;

drivers/net/wireless/ath/wil6210/debugfs.c

+5 −1
Original line number Diff line number Diff line
@@ -799,8 +799,12 @@ static ssize_t wil_write_file_txmgmt(struct file *file, const char __user *buf, 
	struct wireless_dev *wdev = wil_to_wdev(wil);

	struct cfg80211_mgmt_tx_params params;

	int rc;

	void *frame = kmalloc(len, GFP_KERNEL);

	void *frame;



	if (!len)

		return -EINVAL;



	frame = kmalloc(len, GFP_KERNEL);

	if (!frame)

		return -ENOMEM;