aboutsummaryrefslogtreecommitdiff
path: root/net/wireless/wext.c
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2009-09-28 14:50:06 -0700
committerDavid S. Miller <davem@davemloft.net>2009-09-28 14:50:06 -0700
commiteb1cf0f8f7a9e5a6d573d5bd72c015686a042db0 (patch)
treeee5e1e52ef663e1a4d19c7abd6477a8ed75fda41 /net/wireless/wext.c
parent47379052b5c87707bc6e20a2a4f6ac156fb8357c (diff)
parenta0d97d6c7ceddc176b5eed171aa2a52e32cf3eda (diff)
Merge branch 'master' of ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6
Diffstat (limited to 'net/wireless/wext.c')
-rw-r--r--net/wireless/wext.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 5b4a0cee441..60fe57761ca 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -470,7 +470,7 @@ static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
/*
* Get statistics out of the driver
*/
-static struct iw_statistics *get_wireless_stats(struct net_device *dev)
+struct iw_statistics *get_wireless_stats(struct net_device *dev)
{
/* New location */
if ((dev->wireless_handlers != NULL) &&
@@ -773,10 +773,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
essid_compat = 1;
else if (IW_IS_SET(cmd) && (iwp->length != 0)) {
char essid[IW_ESSID_MAX_SIZE + 1];
+ unsigned int len;
+ len = iwp->length * descr->token_size;
- err = copy_from_user(essid, iwp->pointer,
- iwp->length *
- descr->token_size);
+ if (len > IW_ESSID_MAX_SIZE)
+ return -EFAULT;
+
+ err = copy_from_user(essid, iwp->pointer, len);
if (err)
return -EFAULT;