diff options
| author | Daniel Vetter <daniel.vetter@ffwll.ch> | 2017-11-21 11:33:10 +0100 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2017-11-21 14:17:56 +0100 |
| commit | 70c5f93669249886b151812076509f30569aff80 (patch) | |
| tree | 05dce785f3a70e022b91016c87e4092f143a2fef /drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | |
| parent | c83ecfa5851f4d35be88f32dabb3a53f51cf5c32 (diff) | |
| parent | f150891fd9878ef0d9197c4e8451ce67c3bdd014 (diff) | |
| download | op-kernel-dev-70c5f93669249886b151812076509f30569aff80.zip op-kernel-dev-70c5f93669249886b151812076509f30569aff80.tar.gz | |
Merge airlied/drm-next into drm-misc-next
Bake in the conflict between the drm_print.h extraction and the
addition of DRM_DEBUG_LEASES since we lost it a few too many times.
Also fix a new use of drm_plane_helper_check_state in msm to follow
Ville's conversion in
commit a01cb8ba3f6282934cff65e89ab36b18b14cbe27
Author: Ville Syrjälä <ville.syrjala@linux.intel.com>
Date: Wed Nov 1 22:16:19 2017 +0200
drm: Move drm_plane_helper_check_state() into drm_atomic_helper.c
Acked-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Diffstat (limited to 'drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c')
| -rw-r--r-- | drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c index 4eb1e1c..ef72baf 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c @@ -429,7 +429,8 @@ void brcmf_fweh_process_event(struct brcmf_pub *drvr, if (code != BRCMF_E_IF && !fweh->evt_handler[code]) return; - if (datalen > BRCMF_DCMD_MAXLEN) + if (datalen > BRCMF_DCMD_MAXLEN || + datalen + sizeof(*event_packet) > packet_len) return; if (in_interrupt()) |
