nl80211: fix check for valid SSID size in scan operations
authorLuciano Coelho <coelho@ti.com>
Wed, 18 May 2011 21:43:38 +0000 (00:43 +0300)
committerJohn W. Linville <linville@tuxdriver.com>
Thu, 26 May 2011 19:43:28 +0000 (15:43 -0400)
commit208c72f4fe44fe09577e7975ba0e7fa0278f3d03
treef556afcda6931d1ad7d5ab41341a887c0b25f664
parent21bc7af6e5e684b44725b20f679e701e38ceef15
nl80211: fix check for valid SSID size in scan operations

In both trigger_scan and sched_scan operations, we were checking for
the SSID length before assigning the value correctly.  Since the
memory was just kzalloc'ed, the check was always failing and SSID with
over 32 characters were allowed to go through.

This was causing a buffer overflow when copying the actual SSID to the
proper place.

This bug has been there since 2.6.29-rc4.

Cc: stable@kernel.org
Signed-off-by: Luciano Coelho <coelho@ti.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/wireless/nl80211.c