~hc/RK356X_SDK_RELEASE.git

..	..	@@ -973,6 +973,11 @@
973	973	memset(&chap_rec, 0, sizeof(chap_rec));
974	974
975	975	nla_for_each_attr(attr, data, len, rem) {
	976	+ if (nla_len(attr) < sizeof(*param_info)) {
	977	+ rc = -EINVAL;
	978	+ goto exit_set_chap;
	979	+ }
	980	+
976	981	param_info = nla_data(attr);
977	982
978	983	switch (param_info->param) {
..	..	@@ -2755,6 +2760,11 @@
2755	2760	}
2756	2761
2757	2762	nla_for_each_attr(attr, data, len, rem) {
	2763	+ if (nla_len(attr) < sizeof(*iface_param)) {
	2764	+ rval = -EINVAL;
	2765	+ goto exit_init_fw_cb;
	2766	+ }
	2767	+
2758	2768	iface_param = nla_data(attr);
2759	2769
2760	2770	if (iface_param->param_type == ISCSI_NET_PARAM) {
..	..	@@ -8119,6 +8129,11 @@
8119	8129
8120	8130	memset((void *)&chap_tbl, 0, sizeof(chap_tbl));
8121	8131	nla_for_each_attr(attr, data, len, rem) {
	8132	+ if (nla_len(attr) < sizeof(*fnode_param)) {
	8133	+ rc = -EINVAL;
	8134	+ goto exit_set_param;
	8135	+ }
	8136	+
8122	8137	fnode_param = nla_data(attr);
8123	8138
8124	8139	switch (fnode_param->param) {