From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from nbd.name ([2a01:4f8:221:3d45::2]) by bombadil.infradead.org with esmtps (Exim 4.92 #3 (Red Hat Linux)) id 1hdTCf-0004iZ-OV for ath11k@lists.infradead.org; Wed, 19 Jun 2019 05:32:15 +0000 From: John Crispin Subject: [PATCH] ath11k: fix mac_cap_info copy size Date: Wed, 19 Jun 2019 07:32:08 +0200 Message-Id: <20190619053208.17243-1-john@phrozen.org> MIME-Version: 1.0 List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "ath11k" Errors-To: ath11k-bounces+kvalo=adurom.com@lists.infradead.org To: Kalle Valo Cc: ath11k@lists.infradead.org, John Crispin The code currently copies the he_cap field when adding a peer from a six byte to an eight byte buffer. Switch from using the dest buffer length to that of the src buffer. Also make sure that the trailing 2 bytes are zero'ed out. Signed-off-by: John Crispin --- drivers/net/wireless/ath/ath11k/mac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c index 53177a9e3c7e..7239013b59ca 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -1262,8 +1262,9 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar, arg->he_flag = true; + memset(&arg->peer_he_cap_macinfo, 0, sizeof(&arg->peer_he_cap_macinfo)); memcpy(&arg->peer_he_cap_macinfo, he_cap->he_cap_elem.mac_cap_info, - sizeof(arg->peer_he_cap_macinfo)); + sizeof(he_cap->he_cap_elem.mac_cap_info)); memcpy(&arg->peer_he_cap_phyinfo, he_cap->he_cap_elem.phy_cap_info, sizeof(arg->peer_he_cap_phyinfo)); memcpy(&arg->peer_he_ops, &vif->bss_conf.he_operation, -- 2.20.1 _______________________________________________ ath11k mailing list ath11k@lists.infradead.org http://lists.infradead.org/mailman/listinfo/ath11k