2 files changed, 14 insertions, 0 deletions

diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 08265ca15785..487cb627ddba 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1551,6 +1551,13 @@ static int regulatory_hint_core(const char *alpha2)
 
         queue_regulatory_request(request);
 
+        /*
+         * This ensures last_request is populated once modules
+         * come swinging in and calling regulatory hints and
+         * wiphy_apply_custom_regulatory().
+         */
+        flush_scheduled_work();
+
         return 0;
 }
 
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index cb6a5bb85d80..0e59f9ae9b81 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -786,6 +786,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                         err = -EFAULT;
                         goto out;
                 }
+
+                if (cmd == SIOCSIWENCODEEXT) {
+                        struct iw_encode_ext *ee = (void *) extra;
+
+                        if (iwp->length < sizeof(*ee) + ee->key_len)
+                                return -EFAULT;
+                }
         }
 
         err = handler(dev, info, (union iwreq_data *) iwp, extra);