diff options
author | Dominik Sliwa <dominik.sliwa@toradex.com> | 2019-05-09 17:20:01 +0200 |
---|---|---|
committer | Dominik Sliwa <dominik.sliwa@toradex.com> | 2019-05-09 17:20:01 +0200 |
commit | cf2620f8c3bbbcc7ad33452e685cafd727997866 (patch) | |
tree | 9a30b5ddc3c37f88d0c845e42955c2f7291f5e6b /drivers/net/wireless/ath/wil6210/cfg80211.c | |
parent | 04b0b4365fea6da59cdf1c8e9b6377c532ccd965 (diff) |
Backports v4.19.41Colibri-T30_LXDE-Image_2.8b7.-20200610Colibri-T20_LXDE-Image_2.8b7.-20200610Apalis-TK1_Console-Image_3.0b3.118-20191231Apalis-T30_LXDE-Image_2.8b7.-20200610
Backports generated by toradex backports d3921c0fde334dcd67e92cdc955c254525ab62d0
against mainline kernel tag v4.19.41
Signed-off-by: Dominik Sliwa <dominik.sliwa@toradex.com>
Diffstat (limited to 'drivers/net/wireless/ath/wil6210/cfg80211.c')
-rw-r--r-- | drivers/net/wireless/ath/wil6210/cfg80211.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c index f79c337..2daf333 100644 --- a/drivers/net/wireless/ath/wil6210/cfg80211.c +++ b/drivers/net/wireless/ath/wil6210/cfg80211.c @@ -1420,6 +1420,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, u8 *buf, *dpos; const u8 *spos; + if (!ies1) + ies1_len = 0; + + if (!ies2) + ies2_len = 0; + if (ies1_len == 0 && ies2_len == 0) { *merged_ies = NULL; *merged_len = 0; @@ -1429,17 +1435,19 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, u16 ies1_len, buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL); if (!buf) return -ENOMEM; - memcpy(buf, ies1, ies1_len); + if (ies1) + memcpy(buf, ies1, ies1_len); dpos = buf + ies1_len; spos = ies2; - while (spos + 1 < ies2 + ies2_len) { + while (spos && (spos + 1 < ies2 + ies2_len)) { /* IE tag at offset 0, length at offset 1 */ u16 ielen = 2 + spos[1]; if (spos + ielen > ies2 + ies2_len) break; if (spos[0] == WLAN_EID_VENDOR_SPECIFIC && - !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) { + (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len, + spos, ielen))) { memcpy(dpos, spos, ielen); dpos += ielen; } |