diff options
| author | Avinash Patil <patila@marvell.com> | 2013-07-22 19:17:46 -0700 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2013-07-24 11:02:07 -0400 |
| commit | 8795ca61e4ff3db70f2d072a28aaefc29f1a2301 (patch) | |
| tree | 526845a559226dd1f26e6e4ea4496d4220ce3404 /drivers/net/wireless/mwifiex/sta_ioctl.c | |
| parent | 5e4c07987f4db22cbc3e1dadb021baab0a34a57f (diff) | |
| download | linux-8795ca61e4ff3db70f2d072a28aaefc29f1a2301.tar.gz linux-8795ca61e4ff3db70f2d072a28aaefc29f1a2301.tar.bz2 linux-8795ca61e4ff3db70f2d072a28aaefc29f1a2301.zip | |
mwifiex: correct max IE length check for WPS IE
This patch is bug fix for an invalid boundry check for WPS IE.
We should check max IE length against defined macro; instead we were
checking it against size of pointer. Fix it.
Also move IE length check before allocation of memory.
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/mwifiex/sta_ioctl.c')
| -rw-r--r-- | drivers/net/wireless/mwifiex/sta_ioctl.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c index 206c3e038072..c071ce91c8b2 100644 --- a/drivers/net/wireless/mwifiex/sta_ioctl.c +++ b/drivers/net/wireless/mwifiex/sta_ioctl.c @@ -797,15 +797,16 @@ static int mwifiex_set_wps_ie(struct mwifiex_private *priv, u8 *ie_data_ptr, u16 ie_len) { if (ie_len) { - priv->wps_ie = kzalloc(MWIFIEX_MAX_VSIE_LEN, GFP_KERNEL); - if (!priv->wps_ie) - return -ENOMEM; - if (ie_len > sizeof(priv->wps_ie)) { + if (ie_len > MWIFIEX_MAX_VSIE_LEN) { dev_dbg(priv->adapter->dev, "info: failed to copy WPS IE, too big\n"); - kfree(priv->wps_ie); return -1; } + + priv->wps_ie = kzalloc(MWIFIEX_MAX_VSIE_LEN, GFP_KERNEL); + if (!priv->wps_ie) + return -ENOMEM; + memcpy(priv->wps_ie, ie_data_ptr, ie_len); priv->wps_ie_len = ie_len; dev_dbg(priv->adapter->dev, "cmd: Set wps_ie_len=%d IE=%#x\n", |