Merge "wil6210: protect against invalid length of tx management frame" (03f28c16) · Commits · e / devices / android_kernel_sony_msm8998

drivers/net/wireless/ath/wil6210/cfg80211.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -960,7 +960,7 @@ int wil_cfg80211_mgmt_tx(struct wiphy wiphy, struct wireless_dev wdev,
		wil_hex_dump_misc("mgmt tx frame ", DUMP_PREFIX_OFFSET, 16, 1, buf,
		len, true);

		if (len < sizeof(struct ieee80211_mgmt))
		if (len < sizeof(struct ieee80211_hdr_3addr))
		return -EINVAL;

		cmd = kmalloc(sizeof(*cmd) + len, GFP_KERNEL);