Merge tag 'mac80211-next-for-davem-2016-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

Johannes Berg says:

====================
This time we have various things - all across the board:
 * MU-MIMO sniffer support in mac80211
 * a create_singlethread_workqueue() cleanup
 * interface dump filtering that was documented but not implemented
 * support for the new radiotap timestamp field
 * send delBA in two unexpected conditions (as required by the spec)
 * connect keys cleanups - allow only WEP with index 0-3
 * per-station aggregation limit to work around broken APs
 * debugfs improvement for the integrated codel algorithm
and various other small improvements and cleanups.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 8 insertions, 5 deletions

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 0675f513e7b9..9e6e2aaa7766 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -218,7 +218,7 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                                    struct key_params *params, int key_idx,
                                    bool pairwise, const u8 *mac_addr)
 {
-        if (key_idx > 5)
+        if (key_idx < 0 || key_idx > 5)
                 return -EINVAL;
 
         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
@@ -249,7 +249,13 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                 /* Disallow BIP (group-only) cipher as pairwise cipher */
                 if (pairwise)
                         return -EINVAL;
+                if (key_idx < 4)
+                        return -EINVAL;
                 break;
+        case WLAN_CIPHER_SUITE_WEP40:
+        case WLAN_CIPHER_SUITE_WEP104:
+                if (key_idx > 3)
+                        return -EINVAL;
         default:
                 break;
         }
@@ -906,7 +912,7 @@ void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
         if (!wdev->connect_keys)
                 return;
 
-        for (i = 0; i < 6; i++) {
+        for (i = 0; i < 4; i++) {
                 if (!wdev->connect_keys->params[i].cipher)
                         continue;
                 if (rdev_add_key(rdev, dev, i, false, NULL,
@@ -919,9 +925,6 @@ void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
                                 netdev_err(dev, "failed to set defkey %d\n", i);
                                 continue;
                         }
-                if (wdev->connect_keys->defmgmt == i)
-                        if (rdev_set_default_mgmt_key(rdev, dev, i))
-                                netdev_err(dev, "failed to set mgtdef %d\n", i);
         }
 
         kzfree(wdev->connect_keys);