Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless

2 files changed, 15 insertions, 7 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 337be50aef3b..e97827ba8a58 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -132,8 +132,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 
-        [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
-                                         .len = NL80211_HT_CAPABILITY_LEN },
+        [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 
         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
@@ -1253,6 +1252,12 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                         goto bad_res;
                 }
 
+                if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+                    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
+                        result = -EINVAL;
+                        goto bad_res;
+                }
+
                 nla_for_each_nested(nl_txq_params,
                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
                                     rem_txq_params) {
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 0fb142410404..dc23b31594e0 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -259,17 +259,20 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
 {
         const u8 *ie1 = cfg80211_find_ie(num, ies1, len1);
         const u8 *ie2 = cfg80211_find_ie(num, ies2, len2);
-        int r;
 
+        /* equal if both missing */
         if (!ie1 && !ie2)
                 return 0;
-        if (!ie1 || !ie2)
+        /* sort missing IE before (left of) present IE */
+        if (!ie1)
                 return -1;
+        if (!ie2)
+                return 1;
 
-        r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
-        if (r == 0 && ie1[1] != ie2[1])
+        /* sort by length first, then by contents */
+        if (ie1[1] != ie2[1])
                 return ie2[1] - ie1[1];
-        return r;
+        return memcmp(ie1 + 2, ie2 + 2, ie1[1]);
 }
 
 static bool is_bss(struct cfg80211_bss *a,