Merge tag 'v4.4.214' into 10

[sagit-ice-cold/kernel_xiaomi_msm8998.git] / drivers / net / wireless / libertas / cfg.c

diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 8317afd..4f16f87 100644 (file)
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -23,7 +23,7 @@
 
 
 #define CHAN2G(_channel, _freq, _flags) {        \
-       .band             = IEEE80211_BAND_2GHZ, \
+       .band             = NL80211_BAND_2GHZ, \
        .center_freq      = (_freq),             \
        .hw_value         = (_channel),          \
        .flags            = (_flags),            \
@@ -272,6 +272,10 @@ add_ie_rates(u8 *tlv, const u8 *ie, int *nrates)
        int hw, ap, ap_max = ie[1];
        u8 hw_rate;
 
+       if (ap_max > MAX_RATES) {
+               lbs_deb_assoc("invalid rates\n");
+               return tlv;
+       }
        /* Advance past IE header */
        ie += 2;
 
@@ -639,7 +643,7 @@ static int lbs_ret_scan(struct lbs_private *priv, unsigned long dummy,
                if (chan_no != -1) {
                        struct wiphy *wiphy = priv->wdev->wiphy;
                        int freq = ieee80211_channel_to_frequency(chan_no,
-                                                       IEEE80211_BAND_2GHZ);
+                                                       NL80211_BAND_2GHZ);
                        struct ieee80211_channel *channel =
                                ieee80211_get_channel(wiphy, freq);
 
@@ -1265,7 +1269,7 @@ _new_connect_scan_req(struct wiphy *wiphy, struct cfg80211_connect_params *sme)
 {
        struct cfg80211_scan_request *creq = NULL;
        int i, n_channels = ieee80211_get_num_supported_channels(wiphy);
-       enum ieee80211_band band;
+       enum nl80211_band band;
 
        creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
                       n_channels * sizeof(void *),
@@ -1280,7 +1284,7 @@ _new_connect_scan_req(struct wiphy *wiphy, struct cfg80211_connect_params *sme)
 
        /* Scan all available channels */
        i = 0;
-       for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+       for (band = 0; band < NUM_NL80211_BANDS; band++) {
                int j;
 
                if (!wiphy->bands[band])
@@ -1783,6 +1787,9 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
        struct cmd_ds_802_11_ad_hoc_join cmd;
        u8 preamble = RADIO_PREAMBLE_SHORT;
        int ret = 0;
+       int hw, i;
+       u8 rates_max;
+       u8 *rates;
 
        lbs_deb_enter(LBS_DEB_CFG80211);
 
@@ -1843,9 +1850,14 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
        if (!rates_eid) {
                lbs_add_rates(cmd.bss.rates);
        } else {
-               int hw, i;
-               u8 rates_max = rates_eid[1];
-               u8 *rates = cmd.bss.rates;
+               rates_max = rates_eid[1];
+               if (rates_max > MAX_RATES) {
+                       lbs_deb_join("invalid rates");
+                       rcu_read_unlock();
+                       ret = -EINVAL;
+                       goto out;
+               }
+               rates = cmd.bss.rates;
                for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) {
                        u8 hw_rate = lbs_rates[hw].bitrate / 5;
                        for (i = 0; i < rates_max; i++) {
@@ -2161,7 +2173,7 @@ int lbs_cfg_register(struct lbs_private *priv)
        if (lbs_mesh_activated(priv))
                wdev->wiphy->interface_modes |= BIT(NL80211_IFTYPE_MESH_POINT);
 
-       wdev->wiphy->bands[IEEE80211_BAND_2GHZ] = &lbs_band_2ghz;
+       wdev->wiphy->bands[NL80211_BAND_2GHZ] = &lbs_band_2ghz;
 
        /*
         * We could check priv->fwcapinfo && FW_CAPINFO_WPA, but I have