657d1b0dfc
param->u.wpa_key.key_len comes from the user. If it's too large we would write past the end of the array. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>