mac80211: add length check in ieee80211_is_robust_mgmt_frame()
authorJohannes Berg <johannes.berg@intel.com>
Thu, 23 Jan 2014 15:20:29 +0000 (16:20 +0100)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 4 Feb 2014 20:58:07 +0000 (21:58 +0100)
commitd8ca16db6bb23d03fcb794df44bae64ae976f27c
treef577a829374c0f9daba8bf70e1ea3d6ac107089c
parentae811e21df28deb4c2adab0a47fc3da4f56d777b
mac80211: add length check in ieee80211_is_robust_mgmt_frame()

A few places weren't checking that the frame passed to the
function actually has enough data even though the function
clearly documents it must have a payload byte. Make this
safer by changing the function to take an skb and checking
the length inside. The old version is preserved for now as
the rtl* drivers use it and don't have a correct skb.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/rtlwifi/rtl8188ee/trx.c
drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
drivers/net/wireless/rtlwifi/rtl8192se/trx.c
drivers/net/wireless/rtlwifi/rtl8723ae/trx.c
include/linux/ieee80211.h
net/mac80211/rx.c
net/mac80211/tx.c
net/mac80211/wpa.c