mac80211: fix ie memory allocation for scheduled scans

We were not allocating memory for the IEs passed in the scheduled_scan
request and this was causing memory corruption (buffer overflow).

Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 2 insertions, 1 deletions

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 58ffa7d069c7..669d2e32efb6 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -877,7 +877,8 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 local->sched_scan_ies.ie[i] = kzalloc(2 +
                                                       IEEE80211_MAX_SSID_LEN +
-                                                      local->scan_ies_len,
+                                                      local->scan_ies_len +
+                                                      req->ie_len,
                                                       GFP_KERNEL);
                 if (!local->sched_scan_ies.ie[i]) {
                         ret = -ENOMEM;