diff options
| author | Max Krummenacher <max.krummenacher@toradex.com> | 2024-02-05 16:35:46 +0100 |
|---|---|---|
| committer | Max Krummenacher <max.krummenacher@toradex.com> | 2024-02-05 16:36:18 +0100 |
| commit | 340d0000d1e277a5ec64e5bd903dab8ed1df1860 (patch) | |
| tree | b785c59256937102b9f0011ef143b1cb40471b48 /net/mac80211/util.c | |
| parent | 4f79a6f97a8b85a7f887723616825b2427e38059 (diff) | |
| parent | 16e6e107a688046df37976fb6d7310e886c8115d (diff) | |
Merge tag 'v5.4.264' into toradex_5.4.y
This is the 5.4.264 stable release
Conflicts:
drivers/pci/controller/dwc/pci-imx6.c
commit 0f31993721f92 ("PCI: imx6: Install the fault
handler only on compatible match") overlaps with our
not mainlined THUMB work.
Keep both additions
sound/soc/codecs/sgtl5000.c
commit c062676528865 (ASoC: sgtl5000: Reset the
CHIP_CLK_CTRL reg on remove") with a backport of a
"fixes" commit.
Diffstat (limited to 'net/mac80211/util.c')
| -rw-r--r-- | net/mac80211/util.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/net/mac80211/util.c b/net/mac80211/util.c index c1c117fdf318..6223af1c3457 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -1006,10 +1006,6 @@ _ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, } else elem_parse_failed = true; break; - case WLAN_EID_CHALLENGE: - elems->challenge = pos; - elems->challenge_len = elen; - break; case WLAN_EID_VENDOR_SPECIFIC: if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 && pos[2] == 0xf2) { @@ -1289,6 +1285,8 @@ static size_t ieee802_11_find_bssid_profile(const u8 *start, size_t len, for_each_element_id(elem, WLAN_EID_MULTIPLE_BSSID, start, len) { if (elem->datalen < 2) continue; + if (elem->data[0] < 1 || elem->data[0] > 8) + continue; for_each_element(sub, elem->data + 1, elem->datalen - 1) { u8 new_bssid[ETH_ALEN]; @@ -1365,6 +1363,11 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE, nontransmitted_profile, nontransmitted_profile_len); + if (!nontransmitted_profile_len) { + nontransmitted_profile_len = 0; + kfree(nontransmitted_profile); + nontransmitted_profile = NULL; + } } crc = _ieee802_11_parse_elems_crc(start, len, action, elems, filter, @@ -1394,7 +1397,7 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, offsetofend(struct ieee80211_bssid_index, dtim_count)) elems->dtim_count = elems->bssid_index->dtim_count; - kfree(nontransmitted_profile); + elems->nontx_profile = nontransmitted_profile; return crc; } |