Search Linux Wireless

[PATCH 10/12] d80211: Fix skb panic during passive scan

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



From: Ivo van Doorn <ivdoorn@xxxxxxxxx>

Only add the extra_tx_headroom to the len when allocating
the sk_buff. This will prevent using an invalid length for skb_put
which would cause a skb panic inside the driver.

Signed-off-by: Ivo van Doorn <IvDoorn@xxxxxxxxx>
Signed-off-by: Jiri Benc <jbenc@xxxxxxx>

---

 net/d80211/ieee80211_scan.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

27cfdcaec0ff523ce5a09915f76e36348753c9e2
diff --git a/net/d80211/ieee80211_scan.c b/net/d80211/ieee80211_scan.c
index 263de0d..1d77155 100644
--- a/net/d80211/ieee80211_scan.c
+++ b/net/d80211/ieee80211_scan.c
@@ -280,7 +280,7 @@ void ieee80211_init_scan(struct ieee8021
 {
 	struct ieee80211_hdr hdr;
 	u16 fc;
-	int len = 10 + local->hw.extra_tx_headroom;
+	int len = 10;
 	struct rate_control_extra extra;
 
 	/* Only initialize passive scanning if the hardware supports it */
@@ -303,7 +303,8 @@ void ieee80211_init_scan(struct ieee8021
 
 	/* Create a CTS from for broadcasting before
 	 * the low level changes channels */
-	local->scan.skb = alloc_skb(len, GFP_KERNEL);
+	local->scan.skb = alloc_skb(len + local->hw.extra_tx_headroom,
+		GFP_KERNEL);
 	if (!local->scan.skb) {
 		printk(KERN_WARNING "%s: Failed to allocate CTS packet for "
 		       "passive scan\n", local->mdev->name);
-- 
1.3.0

-
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux