diff options
| author | David S. Miller <davem@davemloft.net> | 2015-07-23 00:41:16 -0700 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-07-23 00:41:16 -0700 |
| commit | c5e40ee287db61a79af1746954ee03ebbf1ff8a3 (patch) | |
| tree | 007da00e75e9b84766ac4868421705300e1e2e14 /net/mac80211/mesh_plink.c | |
| parent | 052831879945be0d9fad2216b127147c565ec1b1 (diff) | |
| parent | c5dfd654d0ec0a28fe81e7bd4d4fd984a9855e09 (diff) | |
| download | op-kernel-dev-c5e40ee287db61a79af1746954ee03ebbf1ff8a3.zip op-kernel-dev-c5e40ee287db61a79af1746954ee03ebbf1ff8a3.tar.gz | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Conflicts:
net/bridge/br_mdb.c
br_mdb.c conflict was a function call being removed to fix a bug in
'net' but whose signature was changed in 'net-next'.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mac80211/mesh_plink.c')
| -rw-r--r-- | net/mac80211/mesh_plink.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c index 5438d13..3b59099 100644 --- a/net/mac80211/mesh_plink.c +++ b/net/mac80211/mesh_plink.c @@ -306,7 +306,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata, if (action == WLAN_SP_MESH_PEERING_CONFIRM) { /* AID */ pos = skb_put(skb, 2); - put_unaligned_le16(plid, pos + 2); + put_unaligned_le16(plid, pos); } if (ieee80211_add_srates_ie(sdata, skb, true, band) || ieee80211_add_ext_srates_ie(sdata, skb, true, band) || @@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, WLAN_SP_MESH_PEERING_CONFIRM) { baseaddr += 4; baselen += 4; + + if (baselen > len) + return; } ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems); mesh_process_plink_frame(sdata, mgmt, &elems); |
