| Message ID | 20230117110414.GC12547@altlinux.org |
|---|---|
| State | New |
| Headers | show |
| Series | ath6kl: minor fix for allocation size | expand |
"Alexey V. Vissarionov" <gremlin@altlinux.org> wrote: > Although the "param" pointer occupies more or equal space compared > to "*param", the allocation size should use the size of variable > itself. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver") > Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org> > Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Patch applied to ath-next branch of ath.git, thanks. 778f83f889e7 wifi: ath6kl: minor fix for allocation size
diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c index bde5a10d470c8e74..af98e871199d317f 100644 --- a/drivers/net/wireless/ath/ath6kl/bmi.c +++ b/drivers/net/wireless/ath/ath6kl/bmi.c @@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param) return -EACCES; } - size = sizeof(cid) + sizeof(addr) + sizeof(param); + size = sizeof(cid) + sizeof(addr) + sizeof(*param); if (size > ar->bmi.max_cmd_size) { WARN_ON(1); return -EINVAL;
Although the "param" pointer occupies more or equal space compared to "*param", the allocation size should use the size of variable itself. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver") Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>