wifi: cfg80211: Annotate struct cfg80211_rnr_elems with __counted_by

[platform/kernel/linux-rpi.git] / net / wireless / nl80211.c

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0da2e6a..0ffebf1 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -4889,13 +4889,12 @@ static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
        acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
        if (!acl)
                return ERR_PTR(-ENOMEM);
+       acl->n_acl_entries = n_entries;
 
        nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
                memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
                i++;
        }
-
-       acl->n_acl_entries = n_entries;
        acl->acl_policy = acl_policy;
 
        return acl;
@@ -5430,19 +5429,22 @@ nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
        if (!wiphy->mbssid_max_interfaces)
                return ERR_PTR(-EINVAL);
 
-       nla_for_each_nested(nl_elems, attrs, rem_elems)
+       nla_for_each_nested(nl_elems, attrs, rem_elems) {
+               if (num_elems >= 255)
+                       return ERR_PTR(-EINVAL);
                num_elems++;
+       }
 
        elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
        if (!elems)
                return ERR_PTR(-ENOMEM);
+       elems->cnt = num_elems;
 
        nla_for_each_nested(nl_elems, attrs, rem_elems) {
                elems->elem[i].data = nla_data(nl_elems);
                elems->elem[i].len = nla_len(nl_elems);
                i++;
        }
-       elems->cnt = num_elems;
        return elems;
 }
 
@@ -5468,13 +5470,13 @@ nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
        elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
        if (!elems)
                return ERR_PTR(-ENOMEM);
+       elems->cnt = num_elems;
 
        nla_for_each_nested(nl_elems, attrs, rem_elems) {
                elems->elem[i].data = nla_data(nl_elems);
                elems->elem[i].len = nla_len(nl_elems);
                i++;
        }
-       elems->cnt = num_elems;
        return elems;
 }