Merge branch 'stable-3.2' into pandora-3.2

[pandora-kernel.git] / net / wireless / nl80211.c

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 446d224..41a0ebb 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -158,8 +158,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
        [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
        [NL80211_ATTR_PID] = { .type = NLA_U32 },
        [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
-       [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
-                                .len = WLAN_PMKID_LEN },
+       [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
        [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
        [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
        [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
@@ -3500,6 +3499,10 @@ static int validate_scan_freqs(struct nlattr *freqs)
        struct nlattr *attr1, *attr2;
        int n_channels = 0, tmp1, tmp2;
 
+       nla_for_each_nested(attr1, freqs, tmp1)
+               if (nla_len(attr1) != sizeof(u32))
+                       return 0;
+
        nla_for_each_nested(attr1, freqs, tmp1) {
                n_channels++;
                /*
@@ -5820,6 +5823,9 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
        if (err)
                return err;
 
+       if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
+           !tb[NL80211_REKEY_DATA_KCK])
+               return -EINVAL;
        if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
                return -ERANGE;
        if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)