summaryrefslogtreecommitdiffstats
path: root/net/wireless
diff options
context:
space:
mode:
authorDedy Lansky <dlansky@codeaurora.org>2018-05-17 16:25:03 +0300
committerJohannes Berg <johannes.berg@intel.com>2018-05-18 10:01:58 +0200
commit1039d08100e58f016a814347baadb77bf8dd21ab (patch)
tree83955de339d22a11f32e7ad2008d0390ec69409a /net/wireless
parent814596495dd2b9d4aab92d8f89cf19060d25d2ea (diff)
downloadlinux-stable-1039d08100e58f016a814347baadb77bf8dd21ab.tar.gz
linux-stable-1039d08100e58f016a814347baadb77bf8dd21ab.tar.bz2
linux-stable-1039d08100e58f016a814347baadb77bf8dd21ab.zip
nl80211: fix nlmsg allocation in cfg80211_ft_event
Allocation size of nlmsg in cfg80211_ft_event is based on ric_ies_len and doesn't take into account ies_len. This leads to NL80211_CMD_FT_EVENT message construction failure in case ft_event contains large enough ies buffer. Add ies_len to the nlmsg allocation size. Signed-off-by: Dedy Lansky <dlansky@codeaurora.org> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless')
-rw-r--r--net/wireless/nl80211.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a052693c2e85..7c5135a92d76 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -15555,7 +15555,8 @@ void cfg80211_ft_event(struct net_device *netdev,
if (!ft_event->target_ap)
return;
- msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
+ msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
+ GFP_KERNEL);
if (!msg)
return;