summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/ath/wil6210/cfg80211.c
diff options
context:
space:
mode:
authorHamad Kadmany <qca_hkadmany@qca.qualcomm.com>2017-08-08 14:16:40 +0300
committerKalle Valo <kvalo@qca.qualcomm.com>2017-08-08 21:43:45 +0300
commit6641525ce40ef45641c8f43bb19cd4e471e4cb75 (patch)
tree13a486ca9a9d811d54dc4f3acc4ee91b9525339e /drivers/net/wireless/ath/wil6210/cfg80211.c
parent3588e1110e49fdad7fc8898420a9c71b34a3ca04 (diff)
downloadlinux-6641525ce40ef45641c8f43bb19cd4e471e4cb75.tar.xz
wil6210: protect against invalid length of tx management frame
Validate buffer length has the minimum needed size when sending management frame to protect against possible buffer overrun. Signed-off-by: Hamad Kadmany <qca_hkadmany@qca.qualcomm.com> Signed-off-by: Lior David <qca_liord@qca.qualcomm.com> Signed-off-by: Maya Erez <qca_merez@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers/net/wireless/ath/wil6210/cfg80211.c')
-rw-r--r--drivers/net/wireless/ath/wil6210/cfg80211.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 0b5383a62d42..77af7492420d 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -884,6 +884,9 @@ int wil_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
wil_hex_dump_misc("mgmt tx frame ", DUMP_PREFIX_OFFSET, 16, 1, buf,
len, true);
+ if (len < sizeof(struct ieee80211_hdr_3addr))
+ return -EINVAL;
+
cmd = kmalloc(sizeof(*cmd) + len, GFP_KERNEL);
if (!cmd) {
rc = -ENOMEM;