2 files changed, 8 insertions, 4 deletions

diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 1e008cddd41d..5f6e98ad21a2 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -3893,7 +3893,7 @@ const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len);
  * cfg80211_find_vendor_ie - find vendor specific information element in data
  *
  * @oui: vendor OUI
- * @oui_type: vendor-specific OUI type
+ * @oui_type: vendor-specific OUI type (must be < 0xff), negative means any
  * @ies: data consisting of IEs
  * @len: length of data
  *
@@ -3905,7 +3905,7 @@ const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len);
  * Note: There are no checks on the element length other than having to fit into
  * the given data.
  */
-const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
+const u8 *cfg80211_find_vendor_ie(unsigned int oui, int oui_type,
                                   const u8 *ies, int len);
 
 /**
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index abdf651a70d9..ef2955c89a00 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -364,13 +364,16 @@ const u8 *cfg80211_find_ie(u8 eid, const u8 *ies, int len)
 }
 EXPORT_SYMBOL(cfg80211_find_ie);
 
-const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
+const u8 *cfg80211_find_vendor_ie(unsigned int oui, int oui_type,
                                   const u8 *ies, int len)
 {
         struct ieee80211_vendor_ie *ie;
         const u8 *pos = ies, *end = ies + len;
         int ie_oui;
 
+        if (WARN_ON(oui_type > 0xff))
+                return NULL;
+
         while (pos < end) {
                 pos = cfg80211_find_ie(WLAN_EID_VENDOR_SPECIFIC, pos,
                                        end - pos);
@@ -386,7 +389,8 @@ const u8 *cfg80211_find_vendor_ie(unsigned int oui, u8 oui_type,
                         goto cont;
 
                 ie_oui = ie->oui[0] << 16 | ie->oui[1] << 8 | ie->oui[2];
-                if (ie_oui == oui && ie->oui_type == oui_type)
+                if (ie_oui == oui &&
+                    (oui_type < 0 || ie->oui_type == oui_type))
                         return pos;
 cont:
                 pos += 2 + ie->len;