Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 03b73862 authored by Johannes Berg's avatar Johannes Berg
Browse files

mac80211: fix CSA beacon allocation size 



If the FTM responder settings are changed simultaneously with
the CSA beacon, the buffer size allocated isn't sufficient and
we'll have a heap overrun. Fix this.

While at it, also clean up the ftm_responder assignment, doing
it only if ftm_responder is non-zero is valid as it's 0 to start
with, but not really useful to understand the code.

Fixes: bc847970 ("mac80211: support FTM responder configuration/statistics")
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent c177db2d

net/mac80211/cfg.c

+4 −3
Original line number Diff line number Diff line
@@ -2891,7 +2891,7 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon) 


	len = beacon->head_len + beacon->tail_len + beacon->beacon_ies_len +

	      beacon->proberesp_ies_len + beacon->assocresp_ies_len +

	      beacon->probe_resp_len;

	      beacon->probe_resp_len + beacon->lci_len + beacon->civicloc_len;



	new_beacon = kzalloc(sizeof(*new_beacon) + len, GFP_KERNEL);

	if (!new_beacon)
@@ -2934,7 +2934,8 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon) 
		memcpy(pos, beacon->probe_resp, beacon->probe_resp_len);

		pos += beacon->probe_resp_len;

	}

	if (beacon->ftm_responder)



	/* might copy -1, meaning no changes requested */

	new_beacon->ftm_responder = beacon->ftm_responder;

	if (beacon->lci) {

		new_beacon->lci_len = beacon->lci_len;