Commit 05809c99 authored by Johannes Berg's avatar Johannes Berg Committed by Ben Hutchings

nl80211: validate number of probe response CSA counters

commit ad5987b4 upstream.

Due to an apparent copy/paste bug, the number of counters for the
beacon configuration were checked twice, instead of checking the
number of probe response counters. Fix this to check the number of
probe response counters before parsing those.

Fixes: 9a774c78 ("cfg80211: Support multiple CSA counters")
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
parent c8c65a5a
......@@ -5980,7 +5980,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
params.n_counter_offsets_presp = len / sizeof(u16);
if (rdev->wiphy.max_num_csa_counters &&
(params.n_counter_offsets_beacon >
(params.n_counter_offsets_presp >
rdev->wiphy.max_num_csa_counters))
return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment