diff options
| author | David Woo <xinhua_wu@realsil.com.cn> | 2009-08-12 14:03:44 -0400 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-08-14 09:14:06 -0400 |
| commit | 70bdb6b275d789ddf05c3a858e6b57715539394b (patch) | |
| tree | 35667ac24fcbc9c6efc3ade446d8571d3c34a1fe /net/mac80211/mesh_plink.c | |
| parent | 57ef5ddb456649667438e023f67dd3a3ff3fbed8 (diff) | |
mac80211: Fix invalid length passed to IE parser for PLINK CONFIRM frames
The length of the fixed portion of plink confirm frames is 4 bytes longer than
the other plink_action frames. This path corrects an error in the length
adjustment done for these type of frames.
Signed-off-by: Javier Cardona <javier@cozybit.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/mac80211/mesh_plink.c')
| -rw-r--r-- | net/mac80211/mesh_plink.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c index cb14253587f1..ffcbad75e09b 100644 --- a/net/mac80211/mesh_plink.c +++ b/net/mac80211/mesh_plink.c | |||
| @@ -409,7 +409,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m | |||
| 409 | baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt; | 409 | baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt; |
| 410 | if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) { | 410 | if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) { |
| 411 | baseaddr += 4; | 411 | baseaddr += 4; |
| 412 | baselen -= 4; | 412 | baselen += 4; |
| 413 | } | 413 | } |
| 414 | ieee802_11_parse_elems(baseaddr, len - baselen, &elems); | 414 | ieee802_11_parse_elems(baseaddr, len - baselen, &elems); |
| 415 | if (!elems.peer_link) { | 415 | if (!elems.peer_link) { |