diff options
| author | Alexander Aring <aring@mojatatu.com> | 2018-11-30 01:41:54 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-01-13 11:50:57 +0300 |
| commit | 537e9a8c301d601da81b3966352dd42dce14a08c (patch) | |
| tree | d4c22e61196b4a3576c69c91975c17178accf7ec /drivers/net/ieee802154 | |
| parent | 083d552a890cb7998395ad92f6aacccd082d8f37 (diff) | |
| download | linux-537e9a8c301d601da81b3966352dd42dce14a08c.tar.xz | |
ieee802154: hwsim: fix off-by-one in parse nested
[ Upstream commit a73d4e1490913b76b292f91553b7ba08a65caa3f ]
This patch fixes a off-by-one mistake in nla_parse_nested() functions of
mac802154_hwsim driver. I had to enabled stack protector so I was able
to reproduce it.
Reference: https://github.com/linux-wpan/wpan-tools/issues/17
Signed-off-by: Alexander Aring <aring@mojatatu.com>
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/net/ieee802154')
| -rw-r--r-- | drivers/net/ieee802154/mac802154_hwsim.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c index bf70ab892e69..624bff4d3636 100644 --- a/drivers/net/ieee802154/mac802154_hwsim.c +++ b/drivers/net/ieee802154/mac802154_hwsim.c @@ -500,7 +500,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info) !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE]) return -EINVAL; - if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX + 1, + if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX, info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE], hwsim_edge_policy, NULL)) return -EINVAL; @@ -550,7 +550,7 @@ static int hwsim_set_edge_lqi(struct sk_buff *msg, struct genl_info *info) !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE]) return -EINVAL; - if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX + 1, + if (nla_parse_nested(edge_attrs, MAC802154_HWSIM_EDGE_ATTR_MAX, info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE], hwsim_edge_policy, NULL)) return -EINVAL; |