Dan Carpenter <dan.carpenter@xxxxxxxxxx> wrote:
> This does a "chunk_len - 4" subtraction later when it calls:
>
> ret = wfx_hif_configuration(wdev, buf + 4, chunk_len - 4);
>
> so check for "chunk_len" is less than 4.
>
> Fixes: dcbecb497908 ("staging: wfx: allow new PDS format")
> Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Reviewed-by: Jérôme Pouiller <jerome.pouiller@xxxxxxxxxx>
Patch applied to wireless-next.git, thanks.
f97c81f5b7f8 wifi: wfx: prevent underflow in wfx_send_pds()
--
https://patchwork.kernel.org/project/linux-wireless/patch/Yv8eX7Xv2ubUOvW7@kili/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
