aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--include/net/ieee80211.h5
-rw-r--r--net/ieee80211/ieee80211_rx.c10
2 files changed, 5 insertions, 10 deletions
diff --git a/include/net/ieee80211.h b/include/net/ieee80211.h
index 6394ae4bf17d..27374c27c408 100644
--- a/include/net/ieee80211.h
+++ b/include/net/ieee80211.h
@@ -505,11 +505,6 @@ enum ieee80211_mfie {
505 MFIE_TYPE_GENERIC = 221, 505 MFIE_TYPE_GENERIC = 221,
506}; 506};
507 507
508struct ieee80211_info_element_hdr {
509 u8 id;
510 u8 len;
511} __attribute__ ((packed));
512
513struct ieee80211_info_element { 508struct ieee80211_info_element {
514 u8 id; 509 u8 id;
515 u8 len; 510 u8 len;
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index cae55e5ccb2e..e0337c8fcde8 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -823,10 +823,10 @@ static inline int ieee80211_network_init(struct ieee80211_device *ieee, struct i
823 network->rsn_ie_len = 0; 823 network->rsn_ie_len = 0;
824 824
825 info_element = beacon->info_element; 825 info_element = beacon->info_element;
826 left = stats->len - ((void *)info_element - (void *)beacon); 826 left = stats->len - sizeof(*beacon);
827 while (left >= sizeof(struct ieee80211_info_element_hdr)) { 827 while (left >= sizeof(struct ieee80211_info_element)) {
828 if (sizeof(struct ieee80211_info_element_hdr) + 828 if (sizeof(struct ieee80211_info_element) + info_element->len >
829 info_element->len > left) { 829 left) {
830 IEEE80211_DEBUG_SCAN 830 IEEE80211_DEBUG_SCAN
831 ("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%Zd left=%d.\n", 831 ("SCAN: parse failed: info_element->len + 2 > left : info_element->len+2=%Zd left=%d.\n",
832 info_element->len + 832 info_element->len +
@@ -967,7 +967,7 @@ static inline int ieee80211_network_init(struct ieee80211_device *ieee, struct i
967 break; 967 break;
968 } 968 }
969 969
970 left -= sizeof(struct ieee80211_info_element_hdr) + 970 left -= sizeof(struct ieee80211_info_element) +
971 info_element->len; 971 info_element->len;
972 info_element = (struct ieee80211_info_element *) 972 info_element = (struct ieee80211_info_element *)
973 &info_element->data[info_element->len]; 973 &info_element->data[info_element->len];