2010-04-16 13:48:14

by Stanislaw Gruszka

Subject: [PATCH] iwlwifi: check scan request ie_len

In mac80211 we always check both scan_req->ie and scan_req->ie_len
against zero before usage, in iwlwifi we should do the same.

Remove not needed "left -= ie_len" while at it.

Signed-off-by: Stanislaw Gruszka <[email protected]>
---
drivers/net/wireless/iwlwifi/iwl-scan.c | 6 +++---
1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index d817c9c..83e6291 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -644,10 +644,10 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
if (WARN_ON(left < ie_len))
return len;

- if (ies)
+ if (ies && ie_len) {
memcpy(pos, ies, ie_len);
- len += ie_len;
- left -= ie_len;
+ len += ie_len;
+ }

return (u16)len;
}
--
1.6.2.5

2010-04-16 17:12:44

by Reinette Chatre

Subject: Re: [PATCH] iwlwifi: check scan request ie_len

On Fri, 2010-04-16 at 06:46 -0700, Stanislaw Gruszka wrote:
> In mac80211 we always check both scan_req->ie and scan_req->ie_len
> against zero before usage, in iwlwifi we should do the same.
>
> Remove not needed "left -= ie_len" while at it.
>
> Signed-off-by: Stanislaw Gruszka <[email protected]>
> ---

Acked-by: Reinette Chatre <[email protected]>

Reinette