From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1he2Eh-0003FD-My for ath11k@lists.infradead.org; Thu, 20 Jun 2019 18:56:41 +0000 From: Karthikeyan Periyasamy Subject: [PATCH] ath11k: fix invalid memory access Date: Fri, 21 Jun 2019 00:26:13 +0530 Message-Id: <1561056973-32524-1-git-send-email-periyasa@codeaurora.org> List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "ath11k" Errors-To: ath11k-bounces+kvalo=adurom.com@lists.infradead.org To: ath11k@lists.infradead.org Cc: Karthikeyan Periyasamy dp_reo_cache_flush_elem element get dynamically allocated with invalid size which leads to the access of unallocated memory region or memory corruption. Fix this bug by allocate with dp_reo_cache_flush_elem structure size. Signed-off-by: Karthikeyan Periyasamy --- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index 7654f9a..c64beb5 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -568,7 +568,7 @@ static void ath11k_dp_rx_tid_del_func(struct ath11k_dp *dp, void *ctx, return; } - elem = kzalloc(sizeof(elem), GFP_ATOMIC); + elem = kzalloc(sizeof(*elem), GFP_ATOMIC); if (!elem) { ath11k_warn(ab, "failed to allocate memory for cache flush element\n"); goto free_desc; -- 1.9.1 _______________________________________________ ath11k mailing list ath11k@lists.infradead.org http://lists.infradead.org/mailman/listinfo/ath11k