Commit 3e4f319d authored by Dan Carpenter's avatar Dan Carpenter Committed by John W. Linville

brcmfmac: fix end of loop check (signedness bug)

The problem here is that we loop until "remained_buf_len" is less than
zero, but since it is unsigned, it never is.

"remained_buf_len" has to be large enough to hold the value from
"mgmt_ie_buf_len".  That variable is type u32, but it only holds small
values so I have changed to both variables to int.

Also I removed the bogus initialization from "mgmt_ie_buf_len" so that
GCC can detect if it is used unitialized.  I moved the declaration of
"remained_buf_len" closer to where it is used so it's easier to read.
Reviewed-by: default avatarPieter-Paul Giesberts <pieterpg@broadcom.com>
Reviewed-by: default avatarHante Meuleman <meuleman@broadcom.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarFranky Lin <frankyl@broadcom.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 5dd161ff
...@@ -3972,7 +3972,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg, ...@@ -3972,7 +3972,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg,
u8 *iovar_ie_buf; u8 *iovar_ie_buf;
u8 *curr_ie_buf; u8 *curr_ie_buf;
u8 *mgmt_ie_buf = NULL; u8 *mgmt_ie_buf = NULL;
u32 mgmt_ie_buf_len = 0; int mgmt_ie_buf_len;
u32 *mgmt_ie_len = 0; u32 *mgmt_ie_len = 0;
u32 del_add_ie_buf_len = 0; u32 del_add_ie_buf_len = 0;
u32 total_ie_buf_len = 0; u32 total_ie_buf_len = 0;
...@@ -3982,7 +3982,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg, ...@@ -3982,7 +3982,7 @@ brcmf_set_management_ie(struct brcmf_cfg80211_info *cfg,
struct parsed_vndr_ie_info *vndrie_info; struct parsed_vndr_ie_info *vndrie_info;
s32 i; s32 i;
u8 *ptr; u8 *ptr;
u32 remained_buf_len; int remained_buf_len;
WL_TRACE("bssidx %d, pktflag : 0x%02X\n", bssidx, pktflag); WL_TRACE("bssidx %d, pktflag : 0x%02X\n", bssidx, pktflag);
iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL); iovar_ie_buf = kzalloc(WL_EXTRA_BUF_MAX, GFP_KERNEL);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment