cfg80211: reduce connect key caching struct size

[cascardo/linux.git] / net / wireless / util.c

diff --git a/net/wireless/util.c b/net/wireless/util.c
index 4e809e9..9e6e2aa 100644 (file)
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -218,7 +218,7 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                                   struct key_params *params, int key_idx,
                                   bool pairwise, const u8 *mac_addr)
 {
-       if (key_idx > 5)
+       if (key_idx < 0 || key_idx > 5)
                return -EINVAL;
 
        if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
@@ -249,7 +249,13 @@ int cfg80211_validate_key_settings(struct cfg80211_registered_device *rdev,
                /* Disallow BIP (group-only) cipher as pairwise cipher */
                if (pairwise)
                        return -EINVAL;
+               if (key_idx < 4)
+                       return -EINVAL;
                break;
+       case WLAN_CIPHER_SUITE_WEP40:
+       case WLAN_CIPHER_SUITE_WEP104:
+               if (key_idx > 3)
+                       return -EINVAL;
        default:
                break;
        }
@@ -509,7 +515,7 @@ static int __ieee80211_data_to_8023(struct sk_buff *skb, struct ethhdr *ehdr,
                 * replace EtherType */
                hdrlen += ETH_ALEN + 2;
        else
-               tmp.h_proto = htons(skb->len);
+               tmp.h_proto = htons(skb->len - hdrlen);
 
        pskb_pull(skb, hdrlen);
 
@@ -721,6 +727,8 @@ __ieee80211_amsdu_copy(struct sk_buff *skb, unsigned int hlen,
         * alignment since sizeof(struct ethhdr) is 14.
         */
        frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + cur_len);
+       if (!frame)
+               return NULL;
 
        skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
        skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
@@ -904,7 +912,7 @@ void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
        if (!wdev->connect_keys)
                return;
 
-       for (i = 0; i < 6; i++) {
+       for (i = 0; i < 4; i++) {
                if (!wdev->connect_keys->params[i].cipher)
                        continue;
                if (rdev_add_key(rdev, dev, i, false, NULL,
@@ -917,9 +925,6 @@ void cfg80211_upload_connect_keys(struct wireless_dev *wdev)
                                netdev_err(dev, "failed to set defkey %d\n", i);
                                continue;
                        }
-               if (wdev->connect_keys->defmgmt == i)
-                       if (rdev_set_default_mgmt_key(rdev, dev, i))
-                               netdev_err(dev, "failed to set mgtdef %d\n", i);
        }
 
        kzfree(wdev->connect_keys);
@@ -1557,7 +1562,7 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
        struct wireless_dev *wdev;
        int res = 0;
 
-       if (!beacon_int)
+       if (beacon_int < 10 || beacon_int > 10000)
                return -EINVAL;
 
        list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {