diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2016-09-13 15:53:55 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-09-30 10:12:46 +0200 |
| commit | e402ffdeac99861b5b9c06ce7939815130b281bb (patch) | |
| tree | 95e4d247609ea6ad6a70a4c690422b9e26529cbe | |
| parent | 29adc609e25048bae1ed3261fc9f770a0f2ba91d (diff) | |
| download | linux-stable-e402ffdeac99861b5b9c06ce7939815130b281bb.tar.gz linux-stable-e402ffdeac99861b5b9c06ce7939815130b281bb.tar.bz2 linux-stable-e402ffdeac99861b5b9c06ce7939815130b281bb.zip | |
nl80211: validate number of probe response CSA counters
commit ad5987b47e96a0fb6d13fea250e936aed000093c upstream.
Due to an apparent copy/paste bug, the number of counters for the
beacon configuration were checked twice, instead of checking the
number of probe response counters. Fix this to check the number of
probe response counters before parsing those.
Fixes: 9a774c78e211 ("cfg80211: Support multiple CSA counters")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | net/wireless/nl80211.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 7d72283901a3..7d38dd6971a8 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -6811,7 +6811,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) params.n_counter_offsets_presp = len / sizeof(u16); if (rdev->wiphy.max_num_csa_counters && - (params.n_counter_offsets_beacon > + (params.n_counter_offsets_presp > rdev->wiphy.max_num_csa_counters)) return -EINVAL; |