.. | .. |
---|
1885 | 1885 | if (ret < 0) |
---|
1886 | 1886 | return ret; |
---|
1887 | 1887 | |
---|
| 1888 | + if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { |
---|
| 1889 | + ret = -EIO; |
---|
| 1890 | + goto out; |
---|
| 1891 | + } |
---|
| 1892 | + |
---|
1888 | 1893 | rsp = (void *)hcmd.resp_pkt->data; |
---|
1889 | 1894 | if (le32_to_cpu(rsp->status) != DEBUG_MEM_STATUS_SUCCESS) { |
---|
1890 | 1895 | ret = -ENXIO; |
---|
.. | .. |
---|
1962 | 1967 | if (ret < 0) |
---|
1963 | 1968 | return ret; |
---|
1964 | 1969 | |
---|
| 1970 | + if (iwl_rx_packet_payload_len(hcmd.resp_pkt) < sizeof(*rsp)) { |
---|
| 1971 | + ret = -EIO; |
---|
| 1972 | + goto out; |
---|
| 1973 | + } |
---|
| 1974 | + |
---|
1965 | 1975 | rsp = (void *)hcmd.resp_pkt->data; |
---|
1966 | 1976 | if (rsp->status != DEBUG_MEM_STATUS_SUCCESS) { |
---|
1967 | 1977 | ret = -ENXIO; |
---|