Merge branch 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: (22 commits)
  [PATCH] ibmveth: Fix index increment calculation
  [PATCH] Fix timer race
  [PATCH] Remove useless comment from sb1250
  [PATCH] ucc_geth: changes to ucc_geth driver as a result of qe_lib changes and bugfixes
  [PATCH] sky2: 88E803X transmit lockup
  [PATCH] e1000: Reset all functions after a PCI error
  [PATCH] WAN/pc300: handle, propagate minor errors
  [PATCH] Update smc91x driver with ARM Versatile board info
  [PATCH] wireless: WE-20 compatibility for ESSID and NICKN ioctls
  [PATCH] zd1211rw: fix build-break caused by association race fix
  [PATCH] sotftmac: fix a slab corruption in WEP restricted key association
  [PATCH] airo: check if need to freeze
  [PATCH] wireless: More WE-21 potential overflows...
  [PATCH] zd1201: Possible NULL dereference
  [PATCH] orinoco: fix WE-21 buffer overflow
  [PATCH] airo.c: check returned values
  [PATCH] bcm43xx-softmac: Fix system hang for x86-64 with >1GB RAM
  [PATCH] bcm43xx-softmac: check returned value from pci_enable_device
  [PATCH] softmac: Fix WX and association related races
  [PATCH] bcm43xx: fix race condition in periodic work handler
  ...

1 files changed, 32 insertions, 1 deletions

diff --git a/net/core/wireless.c b/net/core/wireless.c
index ffff0da46c6e..cb1b8728d7ee 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -748,11 +748,39 @@ static int ioctl_standard_call(struct net_device *	dev,
                 int     extra_size;
                 int     user_length = 0;
                 int     err;
+                int     essid_compat = 0;
 
                 /* Calculate space needed by arguments. Always allocate
                  * for max space. Easier, and won't last long... */
                 extra_size = descr->max_tokens * descr->token_size;
 
+                /* Check need for ESSID compatibility for WE < 21 */
+                switch (cmd) {
+                case SIOCSIWESSID:
+                case SIOCGIWESSID:
+                case SIOCSIWNICKN:
+                case SIOCGIWNICKN:
+                        if (iwr->u.data.length == descr->max_tokens + 1)
+                                essid_compat = 1;
+                        else if (IW_IS_SET(cmd) && (iwr->u.data.length != 0)) {
+                                char essid[IW_ESSID_MAX_SIZE + 1];
+
+                                err = copy_from_user(essid, iwr->u.data.pointer,
+                                                     iwr->u.data.length *
+                                                     descr->token_size);
+                                if (err)
+                                        return -EFAULT;
+
+                                if (essid[iwr->u.data.length - 1] == '\0')
+                                        essid_compat = 1;
+                        }
+                        break;
+                default:
+                        break;
+                }
+
+                iwr->u.data.length -= essid_compat;
+
                 /* Check what user space is giving us */
                 if(IW_IS_SET(cmd)) {
                         /* Check NULL pointer */
@@ -795,7 +823,8 @@ static int ioctl_standard_call(struct net_device *	dev,
 #endif  /* WE_IOCTL_DEBUG */
 
                 /* Create the kernel buffer */
-                extra = kmalloc(extra_size, GFP_KERNEL);
+                /*    kzalloc ensures NULL-termination for essid_compat */
+                extra = kzalloc(extra_size, GFP_KERNEL);
                 if (extra == NULL) {
                         return -ENOMEM;
                 }
@@ -819,6 +848,8 @@ static int ioctl_standard_call(struct net_device *	dev,
                 /* Call the handler */
                 ret = handler(dev, &info, &(iwr->u), extra);
 
+                iwr->u.data.length += essid_compat;
+
                 /* If we have something to return to the user */
                 if (!ret && IW_IS_GET(cmd)) {
                         /* Check if there is enough buffer up there */