diff options
| author | Daniel Vetter <daniel.vetter@ffwll.ch> | 2015-08-14 18:10:35 +0200 |
|---|---|---|
| committer | Daniel Vetter <daniel.vetter@ffwll.ch> | 2015-08-14 18:11:30 +0200 |
| commit | 622147fdad5425f6f572f84ce709303e5e0500b7 (patch) | |
| tree | 9b5adde02ed4481db2dc5011a2c9447c8cac12eb /net/mac80211/mesh_plink.c | |
| parent | 5a2376d1360bfc9ebf3b554dd8db1922d42cee4b (diff) | |
| parent | d2944cf21305c754fa8b2d6c1eea05ad5dad7944 (diff) | |
| download | talos-op-linux-622147fdad5425f6f572f84ce709303e5e0500b7.tar.gz talos-op-linux-622147fdad5425f6f572f84ce709303e5e0500b7.zip | |
Merge tag 'drm-intel-fixes-2015-08-14' into drm-intel-next-fixes
Backmerge drm-intel-fixes because a bunch of atomic patch backporting
we had to do lead to horrible conflicts.
Conflicts:
drivers/gpu/drm/drm_crtc.c
Just a bit of context conflict between -next and -fixes.
drivers/gpu/drm/i915/intel_atomic.c
drivers/gpu/drm/i915/intel_display.c
Atomic conflicts, always pick the code from -next.
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Diffstat (limited to 'net/mac80211/mesh_plink.c')
| -rw-r--r-- | net/mac80211/mesh_plink.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c index 5438d13e2f00..3b59099413fb 100644 --- a/net/mac80211/mesh_plink.c +++ b/net/mac80211/mesh_plink.c @@ -306,7 +306,7 @@ static int mesh_plink_frame_tx(struct ieee80211_sub_if_data *sdata, if (action == WLAN_SP_MESH_PEERING_CONFIRM) { /* AID */ pos = skb_put(skb, 2); - put_unaligned_le16(plid, pos + 2); + put_unaligned_le16(plid, pos); } if (ieee80211_add_srates_ie(sdata, skb, true, band) || ieee80211_add_ext_srates_ie(sdata, skb, true, band) || @@ -1122,6 +1122,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, WLAN_SP_MESH_PEERING_CONFIRM) { baseaddr += 4; baselen += 4; + + if (baselen > len) + return; } ieee802_11_parse_elems(baseaddr, len - baselen, true, &elems); mesh_process_plink_frame(sdata, mgmt, &elems); |
