diff options
Diffstat (limited to 'net/wireless')
| -rw-r--r-- | net/wireless/nl80211.c | 9 | ||||
| -rw-r--r-- | net/wireless/scan.c | 9 |
2 files changed, 17 insertions, 1 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index cdb5e9b77143..d947a9f6045a 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -6561,6 +6561,9 @@ nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs, if (ret) return ERR_PTR(ret); + if (num_elems >= 255) + return ERR_PTR(-EINVAL); + num_elems++; } @@ -6993,6 +6996,12 @@ static int nl80211_calculate_ap_capabilities(struct genl_info *info, } } + if (!!params->he_cap != !!params->beacon.he_oper) + return -EINVAL; + + if (!!params->eht_cap != !!params->beacon.eht_oper) + return -EINVAL; + return 0; } diff --git a/net/wireless/scan.c b/net/wireless/scan.c index 358cbc9e43d8..27a56ee2e8f0 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -1071,6 +1071,7 @@ int cfg80211_scan(struct cfg80211_registered_device *rdev) struct cfg80211_scan_request_int *request; struct cfg80211_scan_request_int *rdev_req = rdev->scan_req; u32 n_channels = 0, idx, i; + int err; if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ)) { rdev_req->req.first_part = true; @@ -1100,8 +1101,14 @@ int cfg80211_scan(struct cfg80211_registered_device *rdev) rdev_req->req.scan_6ghz = false; rdev_req->req.first_part = true; + err = rdev_scan(rdev, request); + if (err) { + kfree(request); + return err; + } + rdev->int_scan_req = request; - return rdev_scan(rdev, request); + return 0; } void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, |