brcmfmac: Perform bound checking on vendor command buffer
authorPontus Fuchs <pontusf@broadcom.com>
Fri, 6 Mar 2015 15:18:41 +0000 (16:18 +0100)
committerKalle Valo <kvalo@codeaurora.org>
Sat, 7 Mar 2015 08:52:30 +0000 (10:52 +0200)
commit3f1615340acea54e21f4b9d4d65921540dca84b2
tree36dd5fa76bba565410b585c491719c8197fc18f9
parenteb9f75d88ebc0c17c1025972e5298ab965fee31b
brcmfmac: Perform bound checking on vendor command buffer

A short or malformed vendor command buffer could cause reads outside
the command buffer.

Cc: stable@vger.kernel.org # v3.19
Signed-off-by: Pontus Fuchs <pontusf@broadcom.com>
[arend@broadcom.com: slightly modified debug trace output]
Signed-off-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/brcm80211/brcmfmac/vendor.c