Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem
Conflicts: Documentation/feature-removal-schedule.txt drivers/net/wireless/ath/ath5k/phy.c drivers/net/wireless/wl12xx/wl1271_main.c
This commit is contained in:
@@ -331,11 +331,18 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
|
||||
if (iftype == NL80211_IFTYPE_MESH_POINT) {
|
||||
struct ieee80211s_hdr *meshdr =
|
||||
(struct ieee80211s_hdr *) (skb->data + hdrlen);
|
||||
hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
|
||||
/* make sure meshdr->flags is on the linear part */
|
||||
if (!pskb_may_pull(skb, hdrlen + 1))
|
||||
return -1;
|
||||
if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
|
||||
memcpy(dst, meshdr->eaddr1, ETH_ALEN);
|
||||
memcpy(src, meshdr->eaddr2, ETH_ALEN);
|
||||
skb_copy_bits(skb, hdrlen +
|
||||
offsetof(struct ieee80211s_hdr, eaddr1),
|
||||
dst, ETH_ALEN);
|
||||
skb_copy_bits(skb, hdrlen +
|
||||
offsetof(struct ieee80211s_hdr, eaddr2),
|
||||
src, ETH_ALEN);
|
||||
}
|
||||
hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
|
||||
}
|
||||
break;
|
||||
case cpu_to_le16(IEEE80211_FCTL_FROMDS):
|
||||
@@ -347,9 +354,14 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
|
||||
if (iftype == NL80211_IFTYPE_MESH_POINT) {
|
||||
struct ieee80211s_hdr *meshdr =
|
||||
(struct ieee80211s_hdr *) (skb->data + hdrlen);
|
||||
hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
|
||||
/* make sure meshdr->flags is on the linear part */
|
||||
if (!pskb_may_pull(skb, hdrlen + 1))
|
||||
return -1;
|
||||
if (meshdr->flags & MESH_FLAGS_AE_A4)
|
||||
memcpy(src, meshdr->eaddr1, ETH_ALEN);
|
||||
skb_copy_bits(skb, hdrlen +
|
||||
offsetof(struct ieee80211s_hdr, eaddr1),
|
||||
src, ETH_ALEN);
|
||||
hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
|
||||
}
|
||||
break;
|
||||
case cpu_to_le16(0):
|
||||
@@ -358,7 +370,7 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
|
||||
break;
|
||||
}
|
||||
|
||||
if (unlikely(skb->len - hdrlen < 8))
|
||||
if (!pskb_may_pull(skb, hdrlen + 8))
|
||||
return -1;
|
||||
|
||||
payload = skb->data + hdrlen;
|
||||
|
Reference in New Issue
Block a user