Merge tag 'mac80211-for-davem-2018-09-03' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211
Johannes Berg says: ==================== Here are quite a large number of fixes, notably: * various A-MSDU building fixes (currently only affects mt76) * syzkaller & spectre fixes in hwsim * TXQ vs. teardown fix that was causing crashes * embed WMM info in reg rule, bad code here had been causing crashes * one compilation issue with fix from Arnd (rfkill-gpio includes) * fixes for a race and bad data during/after channel switch * nl80211: a validation fix, attribute type & unit fixes along with other small fixes. ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
@@ -34,6 +34,7 @@
|
||||
#include <net/net_namespace.h>
|
||||
#include <net/netns/generic.h>
|
||||
#include <linux/rhashtable.h>
|
||||
#include <linux/nospec.h>
|
||||
#include "mac80211_hwsim.h"
|
||||
|
||||
#define WARN_QUEUE 100
|
||||
@@ -2820,9 +2821,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
|
||||
IEEE80211_VHT_CAP_SHORT_GI_80 |
|
||||
IEEE80211_VHT_CAP_SHORT_GI_160 |
|
||||
IEEE80211_VHT_CAP_TXSTBC |
|
||||
IEEE80211_VHT_CAP_RXSTBC_1 |
|
||||
IEEE80211_VHT_CAP_RXSTBC_2 |
|
||||
IEEE80211_VHT_CAP_RXSTBC_3 |
|
||||
IEEE80211_VHT_CAP_RXSTBC_4 |
|
||||
IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
|
||||
sband->vht_cap.vht_mcs.rx_mcs_map =
|
||||
@@ -3317,6 +3315,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
|
||||
if (info->attrs[HWSIM_ATTR_CHANNELS])
|
||||
param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
|
||||
|
||||
if (param.channels < 1) {
|
||||
GENL_SET_ERR_MSG(info, "must have at least one channel");
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
|
||||
GENL_SET_ERR_MSG(info, "too many channels specified");
|
||||
return -EINVAL;
|
||||
@@ -3350,6 +3353,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
|
||||
kfree(hwname);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
idx = array_index_nospec(idx,
|
||||
ARRAY_SIZE(hwsim_world_regdom_custom));
|
||||
param.regd = hwsim_world_regdom_custom[idx];
|
||||
}
|
||||
|
||||
|
Reference in New Issue
Block a user