diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2015-07-17 15:39:38 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2015-07-17 15:39:41 +0200 |
| commit | 72bbe3d1c2d7a9e257956912040ffc7ba9f71e0d (patch) | |
| tree | 8f014bc8663c3e0eec3250ceb46ca18674e8932a /net/mac80211/mesh_plink.c | |
| parent | 322cd406da0b102dda9c0eec46181458a3667dbb (diff) | |
| parent | 923b352f19d9ea971ae2536eab55f5fc9e95fedf (diff) | |
| download | op-kernel-dev-72bbe3d1c2d7a9e257956912040ffc7ba9f71e0d.zip op-kernel-dev-72bbe3d1c2d7a9e257956912040ffc7ba9f71e0d.tar.gz | |
Merge branch 'mac80211' into mac80211-next
This is necessary to merge the new TDLS and mesh patches,
as they depend on some fixes.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/mac80211/mesh_plink.c')
| -rw-r--r-- | net/mac80211/mesh_plink.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c index 1a7d983..ac1029f 100644 --- a/net/mac80211/mesh_plink.c +++ b/net/mac80211/mesh_plink.c @@ -306,7 +306,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata, if (action == WLAN_SP_MESH_PEERING_CONFIRM) { /* AID */ pos = skb_put(skb, 2); - put_unaligned_le16(plid, pos + 2); + put_unaligned_le16(plid, pos); } if (ieee80211_add_srates_ie(sdata, skb, true, band) || ieee80211_add_ext_srates_ie(sdata, skb, true, band) || @@ -1123,6 +1123,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, WLAN_SP_MESH_PEERING_CONFIRM) { baseaddr += 4; baselen += 4; + + if (baselen > len) + return; } ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems); mesh_process_plink_frame(sdata, mgmt, &elems); |
