From: Johannes Berg <johannes.berg@xxxxxxxxx> The format is intended to be like the subfields in the QoS Info field, verify that is the case. Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx> --- net/wireless/nl80211.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/net/wireless/nl80211.c 2011-09-07 11:37:54.000000000 +0200 +++ b/net/wireless/nl80211.c 2011-09-07 11:41:39.000000000 +0200 @@ -2611,10 +2611,15 @@ static int nl80211_new_station(struct sk if (tb[NL80211_STA_WME_UAPSD_QUEUES]) params.uapsd_queues = nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]); + if (params.uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) + return -EINVAL; if (tb[NL80211_STA_WME_MAX_SP]) params.max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); + + if (params.max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) + return -EINVAL; } if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
