Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 901ceba4 authored by Stone Piao's avatar Stone Piao Committed by John W. Linville
Browse files

mwifiex: limit channel number not to overflow memory 



Limit the channel number in scan request, or the driver scan
config structure memory will be overflowed.

Cc: <stable@vger.kernel.org> # 3.5+
Signed-off-by: default avatarStone Piao <piaoyun@marvell.com>
Signed-off-by: default avatarBing Zhao <bzhao@marvell.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent b0bb9b39

drivers/net/wireless/mwifiex/cfg80211.c

+2 −1
Original line number Diff line number Diff line
@@ -1892,7 +1892,8 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy, 
		}

	}



	for (i = 0; i < request->n_channels; i++) {

	for (i = 0; i < min_t(u32, request->n_channels,

			      MWIFIEX_USER_SCAN_CHAN_MAX); i++) {

		chan = request->channels[i];

		priv->user_scan_cfg->chan_list[i].chan_number = chan->hw_value;

		priv->user_scan_cfg->chan_list[i].radio_type = chan->band;