| Message ID | 20170917040824.22237-2-cernekee@chromium.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | a7c9acc452b21b56c99dd7dfe0ab542f7baa6563 |
| Delegated to: | Kalle Valo |
| Headers | show |
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c index 4eb1e1ce9ace..27e661fa356f 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c @@ -257,11 +257,6 @@ static void brcmf_fweh_event_worker(struct work_struct *work) brcmf_dbg_hex_dump(BRCMF_EVENT_ON(), event->data, min_t(u32, emsg.datalen, 64), "event payload, len=%d\n", emsg.datalen); - if (emsg.datalen > event->datalen) { - brcmf_err("event invalid length header=%d, msg=%d\n", - event->datalen, emsg.datalen); - goto event_free; - } /* special handling of interface event */ if (event->code == BRCMF_E_IF) {
brcmf_fweh_process_event() sets event->datalen to the endian-swapped value of event_packet->msg.datalen, which is the same as emsg.datalen. This length is already validated in brcmf_fweh_process_event(), so there is no need to check it again upon dequeuing the event. Suggested-by: Arend van Spriel <arend.vanspriel@broadcom.com> Signed-off-by: Kevin Cernekee <cernekee@chromium.org> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 ----- 1 file changed, 5 deletions(-) V2->V3: No change