Merge git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6:
  iwlwifi: fix device id registration for 6000 series 2x2 devices
  ath5k: update channel in sw state after stopping RX and TX
  rtl8187: use DMA-aware buffers with usb_control_msg
  mac80211: avoid NULL ptr deref when finding max_rates in PID and minstrel
  airo: airo_get_encode{,ext} potential buffer overflow

Pulled directly by Linus because Davem is off playing shuffle-board at
some Alaskan cruise, and the NULL ptr deref issue hits people and should
get merged sooner rather than later.

David - make us proud on the shuffle-board tournament!

1 files changed, 8 insertions, 2 deletions

diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c36d3a3d655f..d73475739127 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -6501,7 +6501,10 @@ static int airo_get_encode(struct net_device *dev,
 
         /* Copy the key to the user buffer */
         dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf));
-        memcpy(extra, buf, dwrq->length);
+        if (dwrq->length != -1)
+                memcpy(extra, buf, dwrq->length);
+        else
+                dwrq->length = 0;
 
         return 0;
 }
@@ -6659,7 +6662,10 @@ static int airo_get_encodeext(struct net_device *dev,
         
         /* Copy the key to the user buffer */
         ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
-        memcpy(extra, buf, ext->key_len);
+        if (ext->key_len != -1)
+                memcpy(extra, buf, ext->key_len);
+        else
+                ext->key_len = 0;
 
         return 0;
 }