| From 6c7394197af90f6a332180e33f5d025d3037d883 Mon Sep 17 00:00:00 2001 |
| From: Johannes Berg <johannes.berg@intel.com> |
| Date: Thu, 3 Nov 2011 09:27:01 +0100 |
| Subject: nl80211: fix HT capability attribute validation |
| |
| From: Johannes Berg <johannes.berg@intel.com> |
| |
| commit 6c7394197af90f6a332180e33f5d025d3037d883 upstream. |
| |
| Since the NL80211_ATTR_HT_CAPABILITY attribute is |
| used as a struct, it needs a minimum, not maximum |
| length. Enforce that properly. Not doing so could |
| potentially lead to reading after the buffer. |
| |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: John W. Linville <linville@tuxdriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/wireless/nl80211.c | 3 +-- |
| 1 file changed, 1 insertion(+), 2 deletions(-) |
| |
| --- a/net/wireless/nl80211.c |
| +++ b/net/wireless/nl80211.c |
| @@ -126,8 +126,7 @@ static const struct nla_policy nl80211_p |
| [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, |
| [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, |
| |
| - [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY, |
| - .len = NL80211_HT_CAPABILITY_LEN }, |
| + [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN }, |
| |
| [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, |
| [NL80211_ATTR_IE] = { .type = NLA_BINARY, |
