| From ad5987b47e96a0fb6d13fea250e936aed000093c Mon Sep 17 00:00:00 2001 |
| From: Johannes Berg <johannes.berg@intel.com> |
| Date: Tue, 13 Sep 2016 15:53:55 +0200 |
| Subject: nl80211: validate number of probe response CSA counters |
| |
| From: Johannes Berg <johannes.berg@intel.com> |
| |
| commit ad5987b47e96a0fb6d13fea250e936aed000093c upstream. |
| |
| Due to an apparent copy/paste bug, the number of counters for the |
| beacon configuration were checked twice, instead of checking the |
| number of probe response counters. Fix this to check the number of |
| probe response counters before parsing those. |
| |
| Fixes: 9a774c78e211 ("cfg80211: Support multiple CSA counters") |
| Signed-off-by: Johannes Berg <johannes.berg@intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| net/wireless/nl80211.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/wireless/nl80211.c |
| +++ b/net/wireless/nl80211.c |
| @@ -6811,7 +6811,7 @@ static int nl80211_channel_switch(struct |
| |
| params.n_counter_offsets_presp = len / sizeof(u16); |
| if (rdev->wiphy.max_num_csa_counters && |
| - (params.n_counter_offsets_beacon > |
| + (params.n_counter_offsets_presp > |
| rdev->wiphy.max_num_csa_counters)) |
| return -EINVAL; |
| |
