Hi Johannes, > From: Johannes Berg [mailto:johannes@xxxxxxxxxxxxxxxx] > Sent: Wednesday, September 14, 2016 3:25 PM > To: Bing Zhao; linux-wireless@xxxxxxxxxxxxxxx > Cc: John W. Linville; Amitkumar Karwar; Avinash Patil; Nishant > Sarmukadam; Frank Huang > Subject: Re: [PATCH 2/2] mwifiex: parse WMM IEs from hostapd for mwifiex > AP > > Obviously this is a very old patch, but I was just looking at users of > cfg80211_find_vendor_ie() and realized you have a bug here: > > > + vendor_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT, > > + WLAN_OUI_TYPE_MICROSOFT_ > > WMM, > > + params->beacon.tail, > > + params- > > >beacon.tail_len); > > + if (vendor_ie) { > > + wmm_ie = (struct ieee_types_header *)vendor_ie; > > + memcpy(&bss_cfg->wmm_info, wmm_ie + 1, > > + sizeof(bss_cfg->wmm_info)); > > + priv->wmm_enabled = 1; > > You need to check that the vendor_ie is actually long enough. > Sure. I will prepare a patch to address this. Regards, Amitkumar Karwar
