On Tue, Sep 13, 2011 at 09:49:54AM +0200, Roland Vossen wrote:
> + if (ioc->buf != NULL)
> + buflen = min_t(int, ioc->len, BRCMF_IOCTL_MAXLEN);
^^^^
Should be uint here.
In Linus's tree we cast buflen to int in brcmf_proto_ioctl() so the
cap there doesn't work either.
if (len > BRCMF_C_IOCTL_MAXLEN)
goto done;
(len is negative).
regards,
dan carpenter
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
