1 files changed, 6 insertions, 1 deletions

diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index 7d604c06c3dc..a271c27fac77 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -97,6 +97,10 @@ int ieee80211_radiotap_iterator_init(
         struct ieee80211_radiotap_header *radiotap_header,
         int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
 {
+        /* check the radiotap header can actually be present */
+        if (max_length < sizeof(struct ieee80211_radiotap_header))
+                return -EINVAL;
+
         /* Linux only supports version 0 radiotap format */
         if (radiotap_header->it_version)
                 return -EINVAL;
@@ -131,7 +135,8 @@ int ieee80211_radiotap_iterator_init(
                          */
 
                         if ((unsigned long)iterator->_arg -
-                            (unsigned long)iterator->_rtheader >
+                            (unsigned long)iterator->_rtheader +
+                            sizeof(uint32_t) >
                             (unsigned long)iterator->_max_length)
                                 return -EINVAL;
                 }