diff options
Diffstat (limited to 'net/mac80211/cfg.c')
| -rw-r--r-- | net/mac80211/cfg.c | 24 |
1 files changed, 17 insertions, 7 deletions
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index 7a6f8aba5c46..d44dca56b8ff 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -3191,14 +3191,24 @@ static int ieee80211_set_csa_beacon(struct ieee80211_sub_if_data *sdata, if (params->count <= 1) break; - sdata->csa_counter_offset_beacon = - params->counter_offsets_beacon[0]; + if ((params->n_counter_offsets_beacon > + IEEE80211_MAX_CSA_COUNTERS_NUM) || + (params->n_counter_offsets_presp > + IEEE80211_MAX_CSA_COUNTERS_NUM)) + return -EINVAL; - if (params->n_counter_offsets_presp) - sdata->csa_counter_offset_presp = - params->counter_offsets_presp[0]; - else - sdata->csa_counter_offset_presp = 0; + /* make sure we don't have garbage in other counters */ + memset(sdata->csa_counter_offset_beacon, 0, + sizeof(sdata->csa_counter_offset_beacon)); + memset(sdata->csa_counter_offset_presp, 0, + sizeof(sdata->csa_counter_offset_presp)); + + memcpy(sdata->csa_counter_offset_beacon, + params->counter_offsets_beacon, + params->n_counter_offsets_beacon * sizeof(u16)); + memcpy(sdata->csa_counter_offset_presp, + params->counter_offsets_presp, + params->n_counter_offsets_presp * sizeof(u16)); err = ieee80211_assign_beacon(sdata, ¶ms->beacon_csa); if (err < 0) { |