summaryrefslogtreecommitdiff
path: root/net/wireless
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2014-10-20 14:41:33 (GMT)
committerJohannes Berg <johannes.berg@intel.com>2014-10-20 19:39:29 (GMT)
commit8fa74e3aa6398ffef3c52147c969c0f5f0a1244e (patch)
tree01b6138e17581a27d62e71a013bb85638abd9a7a /net/wireless
parentb08cc24e0a24f8d67ba7d66dab43c40ed25a3f5c (diff)
parent11b2357d5dbce999803e9055f8c09829a8a87db4 (diff)
downloadlinux-8fa74e3aa6398ffef3c52147c969c0f5f0a1244e.tar.xz
Merge branch 'mac80211' into mac80211-next
This was needed to avoid conflicts in the minstrel changes. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
-rw-r--r--net/wireless/nl80211.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0c0f204..d05fe6d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6040,6 +6040,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
int err;
bool need_new_beacon = false;
int len, i;
+ u32 cs_count;
if (!rdev->ops->channel_switch ||
!(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
@@ -6076,7 +6077,14 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
return -EINVAL;
- params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+ /* Even though the attribute is u32, the specification says
+ * u8, so let's make sure we don't overflow.
+ */
+ cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+ if (cs_count > 255)
+ return -EINVAL;
+
+ params.count = cs_count;
if (!need_new_beacon)
goto skip_beacons;