aboutsummaryrefslogtreecommitdiff
path: root/drivers/staging/vt6655/hostap.c
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2014-09-20 10:43:37 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2014-09-20 10:43:37 -0700
commit3c2ea7024a686e9e7121ef6405da7412619a98f5 (patch)
tree86bb6b9fe0993f6b9165b41c5b68c3597a9a1c84 /drivers/staging/vt6655/hostap.c
parentc1fb79e246d08071f6f4135b2866e0f05774153a (diff)
parented87c2b2e7dd34016017af183b8f3fbe28179bc1 (diff)
downloadlinux-stericsson-3c2ea7024a686e9e7121ef6405da7412619a98f5.tar.gz
Merge tag 'staging-3.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
Pull staging / IIO fixes from Greg KH: "Here are some IIO and Staging driver fixes for 3.17-rc6. They are all pretty simple, and resolve reported issues" * tag 'staging-3.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: staging: vt6655: buffer overflow in ioctl iio:magnetometer: bugfix magnetometers gain values iio: adc: at91: don't use the last converted data register iio: adc: xilinx-xadc: assign auxiliary channels address correctly iio: meter: ade7758: Fix indio_dev->trig assignment iio: inv_mpu6050: Fix indio_dev->trig assignment iio: gyro: itg3200: Fix indio_dev->trig assignment iio: st_sensors: Fix indio_dev->trig assignment iio: hid_sensor_hub: Fix indio_dev->trig assignment iio: adc: ad_sigma_delta: Fix indio_dev->trig assignment iio: accel: bma180: Fix indio_dev->trig assignment iio:trigger: modify return value for iio_trigger_get iio:inkern: fix overwritten -EPROBE_DEFER in of_iio_channel_get_by_name
Diffstat (limited to 'drivers/staging/vt6655/hostap.c')
-rw-r--r--drivers/staging/vt6655/hostap.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c
index f105c2ac091b..164136b07a68 100644
--- a/drivers/staging/vt6655/hostap.c
+++ b/drivers/staging/vt6655/hostap.c
@@ -350,6 +350,9 @@ static int hostap_set_generic_element(PSDevice pDevice,
{
PSMgmtObject pMgmt = pDevice->pMgmt;
+ if (param->u.generic_elem.len > sizeof(pMgmt->abyWPAIE))
+ return -EINVAL;
+
memcpy(pMgmt->abyWPAIE,
param->u.generic_elem.data,
param->u.generic_elem.len