diff options
| author | John W. Linville <linville@tuxdriver.com> | 2014-10-27 18:38:15 +0100 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2014-10-27 18:38:15 +0100 |
| commit | 99c814066e75d09e6a38574c6c395f022a04b730 (patch) | |
| tree | f56d74a72e0c0d738c0096e4dfe310d27c42c39b /net/wireless | |
| parent | Merge tag 'iwlwifi-for-john-2014-10-23' of git://git.kernel.org/pub/scm/linux... (diff) | |
| parent | mac80211: minstrels: fix buffer overflow in HT debugfs rc_stats (diff) | |
| download | linux-99c814066e75d09e6a38574c6c395f022a04b730.tar.xz linux-99c814066e75d09e6a38574c6c395f022a04b730.zip | |
Merge tag 'mac80211-for-john-2014-10-23' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
Johannes Berg <johannes@sipsolutions.net> says:
"Here are a few fixes for the wireless stack: one fixes the
RTS rate, one for a debugfs file, one to return the correct
channel to userspace, a sanity check for a userspace value
and the remaining two are just documentation fixes."
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/nl80211.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index cb9f5a44ffad..5839c85075f1 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -5927,6 +5927,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) int err; bool need_new_beacon = false; int len, i; + u32 cs_count; if (!rdev->ops->channel_switch || !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) @@ -5963,7 +5964,14 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) return -EINVAL; - params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); + /* Even though the attribute is u32, the specification says + * u8, so let's make sure we don't overflow. + */ + cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); + if (cs_count > 255) + return -EINVAL; + + params.count = cs_count; if (!need_new_beacon) goto skip_beacons; |