Merge branch 'mac80211' into mac80211-next

This was needed to avoid conflicts in the minstrel changes.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 9 insertions, 1 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 0c0f2045e1f8..d05fe6d6481d 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -6040,6 +6040,7 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         int err;
         bool need_new_beacon = false;
         int len, i;
+        u32 cs_count;
 
         if (!rdev->ops->channel_switch ||
             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
@@ -6076,7 +6077,14 @@ static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
                 return -EINVAL;
 
-        params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+        /* Even though the attribute is u32, the specification says
+         * u8, so let's make sure we don't overflow.
+         */
+        cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
+        if (cs_count > 255)
+                return -EINVAL;
+
+        params.count = cs_count;
 
         if (!need_new_beacon)
                 goto skip_beacons;