Upgrade to 4.4.50-rt62

[kvmfornfv.git] / kernel / drivers / net / wireless / brcm80211 / brcmfmac / cfg80211.c

diff --git a/kernel/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/kernel/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
index deb5f78..70a6985 100644 (file)
--- a/kernel/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+++ b/kernel/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
@@ -2408,7 +2408,7 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
                                     WL_BSS_INFO_MAX);
        if (err) {
                brcmf_err("Failed to get bss info (%d)\n", err);
-               return;
+               goto out_kfree;
        }
        si->filled |= BIT(NL80211_STA_INFO_BSS_PARAM);
        si->bss_param.beacon_interval = le16_to_cpu(buf->bss_le.beacon_period);
@@ -2420,6 +2420,9 @@ static void brcmf_fill_bss_param(struct brcmf_if *ifp, struct station_info *si)
                si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_PREAMBLE;
        if (capability & WLAN_CAPABILITY_SHORT_SLOT_TIME)
                si->bss_param.flags |= BSS_PARAM_FLAGS_SHORT_SLOT_TIME;
+
+out_kfree:
+       kfree(buf);
 }
 
 static s32
@@ -4099,7 +4102,7 @@ brcmf_cfg80211_start_ap(struct wiphy *wiphy, struct net_device *ndev,
                                (u8 *)&settings->beacon.head[ie_offset],
                                settings->beacon.head_len - ie_offset,
                                WLAN_EID_SSID);
-               if (!ssid_ie)
+               if (!ssid_ie || ssid_ie->len > IEEE80211_MAX_SSID_LEN)
                        return -EINVAL;
 
                memcpy(ssid_le.SSID, ssid_ie->data, ssid_ie->len);