diff options
| author | David S. Miller <davem@davemloft.net> | 2020-01-26 12:40:21 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-01-26 12:40:21 +0300 |
| commit | 4d8773b68e83558025303f266070b31bc4101e73 (patch) | |
| tree | 151cafa469fbc6a411d36b58ab802f67869cc0bb /drivers/net/wireless/marvell/libertas/cfg.c | |
| parent | 3333e50b64fe30b7e53cf02456a2f567f689ae4f (diff) | |
| parent | 2821e26f3a0a3872184581caac8115bb02641941 (diff) | |
| download | linux-4d8773b68e83558025303f266070b31bc4101e73.tar.xz | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Minor conflict in mlx5 because changes happened to code that has
moved meanwhile.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/wireless/marvell/libertas/cfg.c')
| -rw-r--r-- | drivers/net/wireless/marvell/libertas/cfg.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c index 57edfada0665..c9401c121a14 100644 --- a/drivers/net/wireless/marvell/libertas/cfg.c +++ b/drivers/net/wireless/marvell/libertas/cfg.c @@ -273,6 +273,10 @@ add_ie_rates(u8 *tlv, const u8 *ie, int *nrates) int hw, ap, ap_max = ie[1]; u8 hw_rate; + if (ap_max > MAX_RATES) { + lbs_deb_assoc("invalid rates\n"); + return tlv; + } /* Advance past IE header */ ie += 2; @@ -1717,6 +1721,9 @@ static int lbs_ibss_join_existing(struct lbs_private *priv, struct cmd_ds_802_11_ad_hoc_join cmd; u8 preamble = RADIO_PREAMBLE_SHORT; int ret = 0; + int hw, i; + u8 rates_max; + u8 *rates; /* TODO: set preamble based on scan result */ ret = lbs_set_radio(priv, preamble, 1); @@ -1775,9 +1782,12 @@ static int lbs_ibss_join_existing(struct lbs_private *priv, if (!rates_eid) { lbs_add_rates(cmd.bss.rates); } else { - int hw, i; - u8 rates_max = rates_eid[1]; - u8 *rates = cmd.bss.rates; + rates_max = rates_eid[1]; + if (rates_max > MAX_RATES) { + lbs_deb_join("invalid rates"); + goto out; + } + rates = cmd.bss.rates; for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) { u8 hw_rate = lbs_rates[hw].bitrate / 5; for (i = 0; i < rates_max; i++) { |