On Tue, Sep 13, 2011 at 09:49:54AM +0200, Roland Vossen wrote:
> + if (ioc->buf != NULL)
> + buflen = min_t(int, ioc->len, BRCMF_IOCTL_MAXLEN);
^^^^
Should be uint here.
In Linus's tree we cast buflen to int in brcmf_proto_ioctl() so the
cap there doesn't work either.
if (len > BRCMF_C_IOCTL_MAXLEN)
goto done;
(len is negative).
regards,
dan carpenter
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
