Commit ad5987b4 authored Sep 13, 2016 by Johannes Berg

nl80211: validate number of probe response CSA counters



Due to an apparent copy/paste bug, the number of counters for the
beacon configuration were checked twice, instead of checking the
number of probe response counters. Fix this to check the number of
probe response counters before parsing those.

Cc: stable@vger.kernel.org
Fixes: 9a774c78 ("cfg80211: Support multiple CSA counters")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

parent 5df20f21

net/wireless/nl80211.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -6978,7 +6978,7 @@ static int nl80211_channel_switch(struct sk_buff skb, struct genl_info info)

		params.n_counter_offsets_presp = len / sizeof(u16);
		if (rdev->wiphy.max_num_csa_counters &&
		(params.n_counter_offsets_beacon >
		(params.n_counter_offsets_presp >
		rdev->wiphy.max_num_csa_counters))
		return -EINVAL;

Admin message