diff options
| author | Malcolm Priestley <tvboxspy@gmail.com> | 2012-11-13 21:04:36 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-11-13 15:10:28 -0800 |
| commit | 848ce5112e7fcb38aaafff28253314da330b681e (patch) | |
| tree | e898d701e6e920bbd641f6b4430d5c71cb1ad03b /drivers/staging/vt6656/main_usb.c | |
| parent | b87ea759a4cc2cae359288f003aae6a027330860 (diff) | |
staging: vt6656: iwctl_giwaplist/device_ioctl : use off stack buffers.
Calls ioctl SIOCGIWAPLIST use off stack buffers.
clears up warning messages.
main_usb.c:2015:1: warning: the frame size of 1888 bytes is larger than 1024 bytes [-Wframe-larger-than=]
iwctl.c:683:1: warning: the frame size of 1280 bytes is larger than 1024 bytes [-Wframe-larger-than=]
Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/vt6656/main_usb.c')
| -rw-r--r-- | drivers/staging/vt6656/main_usb.c | 46 |
1 files changed, 27 insertions, 19 deletions
diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c index d8cb09341482..f3c44aefa41a 100644 --- a/drivers/staging/vt6656/main_usb.c +++ b/drivers/staging/vt6656/main_usb.c @@ -1555,12 +1555,12 @@ static struct net_device_stats *device_get_stats(struct net_device *dev) { static int device_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) { - PSDevice pDevice = (PSDevice)netdev_priv(dev); - PSMgmtObject pMgmt = &(pDevice->sMgmtObj); - PSCmdRequest pReq; - //BOOL bCommit = FALSE; + PSDevice pDevice = (PSDevice)netdev_priv(dev); + PSMgmtObject pMgmt = &pDevice->sMgmtObj; + PSCmdRequest pReq; + u8 *buffer; struct iwreq *wrq = (struct iwreq *) rq; - int rc =0; + int rc = 0; if (pMgmt == NULL) { rc = -EFAULT; @@ -1797,20 +1797,28 @@ static int device_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) { break; case SIOCGIWAPLIST: - { - char buffer[IW_MAX_AP * (sizeof(struct sockaddr) + sizeof(struct iw_quality))]; - - if (wrq->u.data.pointer) { - rc = iwctl_giwaplist(dev, NULL, &(wrq->u.data), buffer); - if (rc == 0) { - if (copy_to_user(wrq->u.data.pointer, - buffer, - (wrq->u.data.length * (sizeof(struct sockaddr) + sizeof(struct iw_quality))) - )) - rc = -EFAULT; - } - } - } + if (wrq->u.data.pointer) { + buffer = kzalloc((sizeof(struct sockaddr) + + sizeof(struct iw_quality)) * IW_MAX_AP, + GFP_KERNEL); + if (buffer == NULL) { + rc = -ENOMEM; + break; + } + + rc = iwctl_giwaplist(dev, NULL, &(wrq->u.data), buffer); + if (rc < 0) { + kfree(buffer); + break; + } + + if (copy_to_user(wrq->u.data.pointer, buffer, + wrq->u.data.length * (sizeof(struct sockaddr) + + sizeof(struct iw_quality)))) + rc = -EFAULT; + + kfree(buffer); + } break; |