From patchwork Tue Jan 17 11:04:14 2023
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: "Alexey V. Vissarionov" <gremlin@altlinux.org>
X-Patchwork-Id: 644041
Return-Path: <linux-wireless-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
 aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
 by smtp.lore.kernel.org (Postfix) with ESMTP id 4E141C63797
 for <linux-wireless@archiver.kernel.org>;
 Tue, 17 Jan 2023 11:04:24 +0000 (UTC)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
 id S235999AbjAQLEW (ORCPT
 <rfc822;linux-wireless@archiver.kernel.org>);
 Tue, 17 Jan 2023 06:04:22 -0500
Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57964 "EHLO
 lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
 with ESMTP id S235897AbjAQLEU (ORCPT
 <rfc822;linux-wireless@vger.kernel.org>);
 Tue, 17 Jan 2023 06:04:20 -0500
Received: from air.basealt.ru (air.basealt.ru [194.107.17.39])
 by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E3CDA2A99B;
 Tue, 17 Jan 2023 03:04:18 -0800 (PST)
Received: by air.basealt.ru (Postfix, from userid 490)
 id 7CAC82F2022C; Tue, 17 Jan 2023 11:04:17 +0000 (UTC)
Received: from localhost (broadband-188-32-10-232.ip.moscow.rt.ru
 [188.32.10.232])
 by air.basealt.ru (Postfix) with ESMTPSA id 6CF1B2F2022A;
 Tue, 17 Jan 2023 11:04:14 +0000 (UTC)
Date: Tue, 17 Jan 2023 14:04:14 +0300
From: "Alexey V. Vissarionov" <gremlin@altlinux.org>
To: Kalle Valo <kvalo@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>,
 Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>,
 Paolo Abeni <pabeni@redhat.com>,
 Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>,
 Raja Mani <rmani@qca.qualcomm.com>,
 Suraj Sumangala <surajs@qca.qualcomm.com>,
 Vivek Natarajan <nataraja@qca.qualcomm.com>,
 Joe Perches <joe@perches.com>, linux-wireless@vger.kernel.org,
 netdev@vger.kernel.org, lvc-project@linuxtesting.org,
 "Alexey V. Vissarionov" <gremlin@altlinux.org>
Subject: [PATCH] ath6kl: minor fix for allocation size
Message-ID: <20230117110414.GC12547@altlinux.org>
MIME-Version: 1.0
Content-Disposition: inline
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

Although the "param" pointer occupies more or equal space compared
to "*param", the allocation size should use the size of variable
itself.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: bdcd81707973cf8a ("Add ath6kl cleaned up driver")
Signed-off-by: Alexey V. Vissarionov <gremlin@altlinux.org>

diff --git a/drivers/net/wireless/ath/ath6kl/bmi.c b/drivers/net/wireless/ath/ath6kl/bmi.c
index bde5a10d470c8e74..af98e871199d317f 100644
--- a/drivers/net/wireless/ath/ath6kl/bmi.c
+++ b/drivers/net/wireless/ath/ath6kl/bmi.c
@@ -246,7 +246,7 @@ int ath6kl_bmi_execute(struct ath6kl *ar, u32 addr, u32 *param)
 		return -EACCES;
 	}
 
-	size = sizeof(cid) + sizeof(addr) + sizeof(param);
+	size = sizeof(cid) + sizeof(addr) + sizeof(*param);
 	if (size > ar->bmi.max_cmd_size) {
 		WARN_ON(1);
 		return -EINVAL;