hc
2024-01-03 2f7c68cb55ecb7331f2381deb497c27155f32faf
kernel/drivers/net/wireless/intel/iwlwifi/dvm/sta.c
....@@ -1086,6 +1086,7 @@
10861086 {
10871087 __le16 key_flags;
10881088 struct iwl_addsta_cmd sta_cmd;
1089
+ size_t to_copy;
10891090 int i;
10901091
10911092 spin_lock_bh(&priv->sta_lock);
....@@ -1105,7 +1106,9 @@
11051106 sta_cmd.key.tkip_rx_tsc_byte2 = tkip_iv32;
11061107 for (i = 0; i < 5; i++)
11071108 sta_cmd.key.tkip_rx_ttak[i] = cpu_to_le16(tkip_p1k[i]);
1108
- memcpy(sta_cmd.key.key, keyconf->key, keyconf->keylen);
1109
+ /* keyconf may contain MIC rx/tx keys which iwl does not use */
1110
+ to_copy = min_t(size_t, sizeof(sta_cmd.key.key), keyconf->keylen);
1111
+ memcpy(sta_cmd.key.key, keyconf->key, to_copy);
11091112 break;
11101113 case WLAN_CIPHER_SUITE_WEP104:
11111114 key_flags |= STA_KEY_FLG_KEY_SIZE_MSK;