wl3501_cs: Fix out-of-bounds warnings in wl3501_send_pkt

[mirror_ubuntu-focal-kernel.git] / drivers / net / wireless / wl3501_cs.c

diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 007bf6803293930e93a70c8707ff90112160f167..96eb69678855dafb0edb07470e6616ef00064884 100644 (file)
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -469,6 +469,7 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)
        struct wl3501_md_req sig = {
                .sig_id = WL3501_SIG_MD_REQ,
        };
+       size_t sig_addr_len = sizeof(sig.addr);
        u8 *pdata = (char *)data;
        int rc = -EIO;
 
@@ -484,9 +485,9 @@ static int wl3501_send_pkt(struct wl3501_card *this, u8 *data, u16 len)
                        goto out;
                }
                rc = 0;
-               memcpy(&sig.daddr[0], pdata, 12);
-               pktlen = len - 12;
-               pdata += 12;
+               memcpy(&sig.addr, pdata, sig_addr_len);
+               pktlen = len - sig_addr_len;
+               pdata += sig_addr_len;
                sig.data = bf;
                if (((*pdata) * 256 + (*(pdata + 1))) > 1500) {
                        u8 addr4[ETH_ALEN] = {
@@ -980,7 +981,8 @@ static inline void wl3501_md_ind_interrupt(struct net_device *dev,
        } else {
                skb->dev = dev;
                skb_reserve(skb, 2); /* IP headers on 16 bytes boundaries */
-               skb_copy_to_linear_data(skb, (unsigned char *)&sig.daddr, 12);
+               skb_copy_to_linear_data(skb, (unsigned char *)&sig.addr,
+                                       sizeof(sig.addr));
                wl3501_receive(this, skb->data, pkt_len);
                skb_put(skb, pkt_len);
                skb->protocol   = eth_type_trans(skb, dev);