diff options
| author | Zhu Jianmin <jianminz@codeaurora.org> | 2018-06-12 18:18:25 +0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-06-15 04:37:17 -0700 |
| commit | df55603b24bc48fd765332d71a9ca1f82c1e8e39 (patch) | |
| tree | 2d52d62c06cfcaf0c7ae51b04e5a4c67e3441736 /net/wireless/nl80211.c | |
| parent | 37805d9fefe0318c7cd57b26e9d7659e87aef69a (diff) | |
nl80211: fix nlmsg allocation in cfg80211_ft_event
Allocation size of nlmsg in cfg80211_ft_event is based on ric_ies_len
and doesn't take into account ies_len. This leads to
NL80211_CMD_FT_EVENT message construction failure in case ft_event
contains large enough ies buffer.
Add ies_len to the nlmsg allocation size.
Signed-off-by: Dedy Lansky <dlansky@codeaurora.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: 1039d08100e58f016a814347baadb77bf8dd21ab
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Change-Id: I224ac6113e4b15958f3b155982ff5cf84ff9ed74
CRs-Fixed: 2207276
Signed-off-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Zhu Jianmin <jianminz@codeaurora.org>
Diffstat (limited to 'net/wireless/nl80211.c')
| -rw-r--r-- | net/wireless/nl80211.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index f08ed375bb91..4490dec28f50 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -13807,7 +13807,8 @@ void cfg80211_ft_event(struct net_device *netdev, if (!ft_event->target_ap) return; - msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL); + msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, + GFP_KERNEL); if (!msg) return; |