mwifiex: correct max IE length check for WPS IE (8795ca61) · Commits · 戴 / test

This patch is bug fix for an invalid boundry check for WPS IE. We should check max IE length against defined macro; instead we were checking it against size of pointer. Fix it. Also move IE length check before allocation of memory. Signed-off-by:

Avinash Patil <patila@marvell.com> Signed-off-by:

Bing Zhao <bzhao@marvell.com> Signed-off-by:

John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/mwifiex/sta_ioctl.c

+6 −5

Original line number	Diff line number	Diff line
		@@ -797,15 +797,16 @@ static int mwifiex_set_wps_ie(struct mwifiex_private *priv,
		u8 *ie_data_ptr, u16 ie_len)
		{
		if (ie_len) {
		priv->wps_ie = kzalloc(MWIFIEX_MAX_VSIE_LEN, GFP_KERNEL);
		if (!priv->wps_ie)
		return -ENOMEM;
		if (ie_len > sizeof(priv->wps_ie)) {
		if (ie_len > MWIFIEX_MAX_VSIE_LEN) {
		dev_dbg(priv->adapter->dev,
		"info: failed to copy WPS IE, too big\n");
		kfree(priv->wps_ie);
		return -1;
		}

		priv->wps_ie = kzalloc(MWIFIEX_MAX_VSIE_LEN, GFP_KERNEL);
		if (!priv->wps_ie)
		return -ENOMEM;

		memcpy(priv->wps_ie, ie_data_ptr, ie_len);
		priv->wps_ie_len = ie_len;
		dev_dbg(priv->adapter->dev, "cmd: Set wps_ie_len=%d IE=%#x\n",

Admin message