Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 113630b5 authored by Karthik D A's avatar Karthik D A Committed by Kalle Valo
Browse files

mwifiex: vendor_ie length check for parse WMM IEs 



While copying the vendor_ie obtained from the cfg80211_find_vendor_ie()
to the struct mwifiex_types_wmm_info, length/size was inappropriate.
This patch corrects the required length needed to the
mwifiex_types_wmm_info

Signed-off-by: default avatarKarthik D A <karthida@marvell.com>
Signed-off-by: default avatarAmitkumar Karwar <akarwar@marvell.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent c44c0403

drivers/net/wireless/marvell/mwifiex/uap_cmd.c

+4 −4
Original line number Diff line number Diff line
@@ -404,7 +404,7 @@ mwifiex_set_wmm_params(struct mwifiex_private *priv, 
		       struct cfg80211_ap_settings *params)

{

	const u8 *vendor_ie;

	struct ieee_types_header *wmm_ie;

	const u8 *wmm_ie;

	u8 wmm_oui[] = {0x00, 0x50, 0xf2, 0x02};



	vendor_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
@@ -412,9 +412,9 @@ mwifiex_set_wmm_params(struct mwifiex_private *priv, 
					    params->beacon.tail,

					    params->beacon.tail_len);

	if (vendor_ie) {

		wmm_ie = (struct ieee_types_header *)vendor_ie;

		memcpy(&bss_cfg->wmm_info, wmm_ie + 1,

		       sizeof(bss_cfg->wmm_info));

		wmm_ie = vendor_ie;

		memcpy(&bss_cfg->wmm_info, wmm_ie +

		       sizeof(struct ieee_types_header), *(wmm_ie + 1));

		priv->wmm_enabled = 1;

	} else {

		memset(&bss_cfg->wmm_info, 0, sizeof(bss_cfg->wmm_info));