I forgot to convert the radiotap length to CPU endian, which sparse found thankfully. Apologies that the queue patch is requiring so many fixups. Signed-off-by: Johannes Berg <johannes@xxxxxxxxxxxxxxxx> Cc: stable@xxxxxxxxxx --- net/mac80211/iface.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- wireless-testing.orig/net/mac80211/iface.c 2010-01-08 18:24:05.000000000 +0100 +++ wireless-testing/net/mac80211/iface.c 2010-01-08 18:24:20.000000000 +0100 @@ -689,10 +689,10 @@ static u16 ieee80211_monitor_select_queu return 0; if (skb->len < 4 || - skb->len < rtap->it_len + 2 /* frame control */) + skb->len < le16_to_cpu(rtap->it_len) + 2 /* frame control */) return 0; /* doesn't matter, frame will be dropped */ - hdr = (void *)((u8 *)skb->data + rtap->it_len); + hdr = (void *)((u8 *)skb->data + le16_to_cpu(rtap->it_len)); if (!ieee80211_is_data(hdr->frame_control)) { skb->priority = 7; -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html