diff options
| author | Luciano Coelho <coelho@ti.com> | 2011-07-07 15:18:27 +0300 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-07-07 13:06:08 -0400 |
| commit | 1186980dafcd14d0e257a4dd6990cefdc6f3e362 (patch) | |
| tree | 7c896a4440ec281f7d8dc82adfd79bd7cf8475f4 /net/mac80211 | |
| parent | 6ae8ec27868bfdbb815287bee8146acbefaee867 (diff) | |
mac80211: fix ie memory allocation for scheduled scans
We were not allocating memory for the IEs passed in the scheduled_scan
request and this was causing memory corruption (buffer overflow).
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211')
| -rw-r--r-- | net/mac80211/scan.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c index 58ffa7d069c..669d2e32efb 100644 --- a/net/mac80211/scan.c +++ b/net/mac80211/scan.c @@ -877,7 +877,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata, for (i = 0; i < IEEE80211_NUM_BANDS; i++) { local->sched_scan_ies.ie[i] = kzalloc(2 + IEEE80211_MAX_SSID_LEN + - local->scan_ies_len, + local->scan_ies_len + + req->ie_len, GFP_KERNEL); if (!local->sched_scan_ies.ie[i]) { ret = -ENOMEM; |