From: Pali Rohár <pali.rohar@gmail.com>
Date: Thu, 9 Nov 2017 23:38:23 +0000 (+0100)
Subject: wl1251: Update wl->nvs_len after wl->nvs is valid
X-Git-Tag: v4.17-rc1~148^2~101^2~65
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f63b4c971f5fb1310f145785c3b2b77651ef129e;p=thirdparty%2Fkernel%2Flinux.git

wl1251: Update wl->nvs_len after wl->nvs is valid

If kmemdup fails, then wl->nvs_len will contain invalid non-zero size.

Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
---

diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 037defd10b918..412fbd4130030 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -122,8 +122,7 @@ static int wl1251_fetch_nvs(struct wl1251 *wl)
 		goto out;
 	}
 
-	wl->nvs_len = fw->size;
-	wl->nvs = kmemdup(fw->data, wl->nvs_len, GFP_KERNEL);
+	wl->nvs = kmemdup(fw->data, fw->size, GFP_KERNEL);
 
 	if (!wl->nvs) {
 		wl1251_error("could not allocate memory for the nvs file");
@@ -131,6 +130,8 @@ static int wl1251_fetch_nvs(struct wl1251 *wl)
 		goto out;
 	}
 
+	wl->nvs_len = fw->size;
+
 	ret = 0;
 
 out: