diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2014-10-20 16:41:33 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2014-10-20 21:39:29 +0200 |
| commit | 8fa74e3aa6398ffef3c52147c969c0f5f0a1244e (patch) | |
| tree | 01b6138e17581a27d62e71a013bb85638abd9a7a /net/wireless | |
| parent | b08cc24e0a24f8d67ba7d66dab43c40ed25a3f5c (diff) | |
| parent | 11b2357d5dbce999803e9055f8c09829a8a87db4 (diff) | |
Merge branch 'mac80211' into mac80211-next
This was needed to avoid conflicts in the minstrel changes.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/nl80211.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 0c0f2045e1f8..d05fe6d6481d 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -6040,6 +6040,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) int err; bool need_new_beacon = false; int len, i; + u32 cs_count; if (!rdev->ops->channel_switch || !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) @@ -6076,7 +6077,14 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) return -EINVAL; - params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); + /* Even though the attribute is u32, the specification says + * u8, so let's make sure we don't overflow. + */ + cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); + if (cs_count > 255) + return -EINVAL; + + params.count = cs_count; if (!need_new_beacon) goto skip_beacons; |