diff options
| -rw-r--r-- | drivers/misc/mediatek/combo/drv_wlan/mt6630/wlan/os/linux/gl_vendor.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/misc/mediatek/combo/drv_wlan/mt6630/wlan/os/linux/gl_vendor.c b/drivers/misc/mediatek/combo/drv_wlan/mt6630/wlan/os/linux/gl_vendor.c index 511d5996d5ef..0174cade617f 100644 --- a/drivers/misc/mediatek/combo/drv_wlan/mt6630/wlan/os/linux/gl_vendor.c +++ b/drivers/misc/mediatek/combo/drv_wlan/mt6630/wlan/os/linux/gl_vendor.c @@ -134,6 +134,7 @@ int mtk_cfg80211_vendor_set_config(struct wiphy *wiphy, struct wireless_dev *wde struct nlattr *pbucket, *pchannel; UINT_32 len_basic, len_bucket, len_channel; int i, j, k; + UINT_32 u4ArySize; static struct nla_policy policy[GSCAN_ATTRIBUTE_REPORT_EVENTS + 1] = { [GSCAN_ATTRIBUTE_NUM_BUCKETS] = {.type = NLA_U32}, [GSCAN_ATTRIBUTE_BASE_PERIOD] = {.type = NLA_U32}, @@ -174,7 +175,10 @@ int mtk_cfg80211_vendor_set_config(struct wiphy *wiphy, struct wireless_dev *wde len_basic += NLA_ALIGN(attr[k]->nla_len); break; case GSCAN_ATTRIBUTE_NUM_BUCKETS: - prWifiScanCmd->num_buckets = nla_get_u32(attr[k]); + u4ArySize = nla_get_u32(attr[k]); + prWifiScanCmd->num_buckets = + (u4ArySize <= GSCAN_MAX_BUCKETS) + ? u4ArySize : GSCAN_MAX_BUCKETS; len_basic += NLA_ALIGN(attr[k]->nla_len); DBGLOG(SCN, INFO, "attr=0x%x, num_buckets=%d nla_len=%d, \r\n", *(UINT_32 *) attr[k], prWifiScanCmd->num_buckets, attr[k]->nla_len); |