Merge "wil6210: potential buffer overflow in wmi_evt_aoa_meas" (6604cb54) · Commits · e / devices / android_kernel_sony_msm8998

drivers/net/wireless/ath/wil6210/ftm.c

+4 −0

Original line number	Original line	Diff line number	Diff line
	@@ -685,6 +685,10 @@ void wil_aoa_evt_meas(struct wil6210_priv *wil,
	int data_len = len - offsetof(struct wmi_aoa_meas_event, meas_data);		int data_len = len - offsetof(struct wmi_aoa_meas_event, meas_data);
	struct wil_aoa_meas_result *res;		struct wil_aoa_meas_result *res;

			if (data_len < 0) {
			wil_err(wil, "AOA event too short (%d)\n", len);
			return;
			}
	data_len = min_t(int, le16_to_cpu(evt->length), data_len);		data_len = min_t(int, le16_to_cpu(evt->length), data_len);

	res = kmalloc(sizeof(*res) + data_len, GFP_KERNEL);		res = kmalloc(sizeof(*res) + data_len, GFP_KERNEL);