mac80211: fix ie memory allocation for scheduled scans
authorLuciano Coelho <coelho@ti.com>
Thu, 7 Jul 2011 12:18:27 +0000 (15:18 +0300)
committerJohn W. Linville <linville@tuxdriver.com>
Thu, 7 Jul 2011 17:06:08 +0000 (13:06 -0400)
We were not allocating memory for the IEs passed in the scheduled_scan
request and this was causing memory corruption (buffer overflow).

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/mac80211/scan.c

index 58ffa7d069c791c7d2c2c681861212d806260956..669d2e32efb61475384c2134840ce43bf15e2eed 100644 (file)
@@ -877,7 +877,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                local->sched_scan_ies.ie[i] = kzalloc(2 +
                                                      IEEE80211_MAX_SSID_LEN +
-                                                     local->scan_ies_len,
+                                                     local->scan_ies_len +
+                                                     req->ie_len,
                                                      GFP_KERNEL);
                if (!local->sched_scan_ies.ie[i]) {
                        ret = -ENOMEM;