From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Sun, 23 Sep 2012 16:33:00 +0000 (+0300)
Subject: mwifiex: potential corruption in mwifiex_update_uap_custom_ie()
X-Git-Tag: v3.7-rc1~145^2~30^2~45
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=fd0fc5218dc31d446fd108a6a571702a7c9bec29;p=profile%2Fivi%2Fkernel-adaptation-intel-automotive.git

mwifiex: potential corruption in mwifiex_update_uap_custom_ie()

ap_custom_ie is a struct mwifiex_ie_list which is quite different and
also larger than struct mwifiex_ie.  It's a difference between 4196
bytes and 262.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Tested-by: Stone Piao <piaoyun@marvell.com>
Acked-by: Bing Zhao <bzhao@marvell.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/drivers/net/wireless/mwifiex/ie.c b/drivers/net/wireless/mwifiex/ie.c
index 1d8dd00..fa3a80f 100644
--- a/drivers/net/wireless/mwifiex/ie.c
+++ b/drivers/net/wireless/mwifiex/ie.c
@@ -160,7 +160,7 @@ mwifiex_update_uap_custom_ie(struct mwifiex_private *priv,
 	u16 len;
 	int ret;
 
-	ap_custom_ie = kzalloc(sizeof(struct mwifiex_ie), GFP_KERNEL);
+	ap_custom_ie = kzalloc(sizeof(*ap_custom_ie), GFP_KERNEL);
 	if (!ap_custom_ie)
 		return -ENOMEM;