diff options
| author |   Dedy Lansky <dlansky@codeaurora.org> | 2018-05-17 16:25:03 +0300 |
|---|---|---|
| committer |   Johannes Berg <johannes.berg@intel.com> | 2018-05-18 10:01:58 +0200 |
| commit | 1039d08100e58f016a814347baadb77bf8dd21ab (patch) | |
| tree | 83955de339d22a11f32e7ad2008d0390ec69409a /net | |
| parent | cfg80211: further limit wiphy names to 64 bytes (diff) | |
| download | linux-dev-1039d08100e58f016a814347baadb77bf8dd21ab.tar.xz linux-dev-1039d08100e58f016a814347baadb77bf8dd21ab.zip | |
nl80211: fix nlmsg allocation in cfg80211_ft_event
Allocation size of nlmsg in cfg80211_ft_event is based on ric_ies_len
and doesn't take into account ies_len. This leads to
NL80211_CMD_FT_EVENT message construction failure in case ft_event
contains large enough ies buffer.
Add ies_len to the nlmsg allocation size.
Signed-off-by: Dedy Lansky <dlansky@codeaurora.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/wireless/nl80211.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index a052693c2e85..7c5135a92d76 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -15555,7 +15555,8 @@ void cfg80211_ft_event(struct net_device *netdev, if (!ft_event->target_ap) return; - msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL); + msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, + GFP_KERNEL); if (!msg) return; |