diff options
| author | David S. Miller <davem@davemloft.net> | 2014-01-07 02:37:45 +0400 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2014-01-07 02:37:45 +0400 |
| commit | 56a4342dfe3145cd66f766adccb28fd9b571606d (patch) | |
| tree | d1593764488ff8cbb0b83cb9ae35fd968bf81760 /net/wireless/radiotap.c | |
| parent | 805c1f4aedaba1bc8d839e7c27b128083dd5c2f0 (diff) | |
| parent | fe0d692bbc645786bce1a98439e548ae619269f5 (diff) | |
| download | linux-56a4342dfe3145cd66f766adccb28fd9b571606d.tar.xz | |
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
Conflicts:
drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
net/ipv6/ip6_tunnel.c
net/ipv6/ip6_vti.c
ipv6 tunnel statistic bug fixes conflicting with consolidation into
generic sw per-cpu net stats.
qlogic conflict between queue counting bug fix and the addition
of multiple MAC address support.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/wireless/radiotap.c')
| -rw-r--r-- | net/wireless/radiotap.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c index a271c27fac77..722da616438c 100644 --- a/net/wireless/radiotap.c +++ b/net/wireless/radiotap.c @@ -124,6 +124,10 @@ int ieee80211_radiotap_iterator_init( /* find payload start allowing for extended bitmap(s) */ if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) { + if ((unsigned long)iterator->_arg - + (unsigned long)iterator->_rtheader + sizeof(uint32_t) > + (unsigned long)iterator->_max_length) + return -EINVAL; while (get_unaligned_le32(iterator->_arg) & (1 << IEEE80211_RADIOTAP_EXT)) { iterator->_arg += sizeof(uint32_t); |