From 4319e193271dc93241338eb0173fc26dc6c35465 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Wed, 7 Sep 2011 11:50:48 +0200 Subject: [PATCH] cfg80211: verify format of uAPSD information The format is intended to be like the subfields in the QoS Info field, verify that is the case. Signed-off-by: Johannes Berg Signed-off-by: John W. Linville --- net/wireless/nl80211.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index f4cfd3abfbf..11089541bb0 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -2627,10 +2627,15 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) if (tb[NL80211_STA_WME_UAPSD_QUEUES]) params.uapsd_queues = nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]); + if (params.uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) + return -EINVAL; if (tb[NL80211_STA_WME_MAX_SP]) params.max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); + + if (params.max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) + return -EINVAL; } if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && -- 2.20.1