Ticket #1024: getappiebuf.2.patch

net80211/ieee80211_wireless.c

@@ -3021 +3021 @@
-static int
-ieee80211_ioctl_setappiebuf(struct net_device *dev,
-        struct iw_request_info *info,
-void *w
+struct iw_point *data
-{
-        struct ieee80211vap *vap = dev->priv;
-        struct ieee80211req_getset_appiebuf *iebuf =
-                (struct ieee80211req_getset_appiebuf *)extra;
-        enum ieee80211_opmode chk_opmode;
+        int iebuf_len;
-        int rc = 0;
-
-
+
+
+
-                return -EINVAL;
-
-        switch (iebuf->app_frmtype) {
@@ -3060 +3063 @@
-
-static int
-ieee80211_ioctl_getappiebuf(struct net_device *dev, struct iw_request_info *info,
-void *w
+struct iw_point *data
-{
-        struct ieee80211vap *vap = dev->priv;
-        struct ieee80211req_getset_appiebuf *iebuf =
-                (struct ieee80211req_getset_appiebuf *)extra;
+        int max_iebuf_len;
+        int rc = 0;
-
+        max_iebuf_len = data->length - sizeof(struct ieee80211req_getset_appiebuf);
+        if (max_iebuf_len < 0)
+                return -EINVAL;
+        if (copy_from_user(iebuf, data->pointer, sizeof(struct ieee80211req_getset_appiebuf)))
+                return -EFAULT;         
+        if (iebuf->app_buflen > max_iebuf_len)
+                iebuf->app_buflen = max_iebuf_len;
+
-        switch (iebuf->app_frmtype) {
-        case IEEE80211_APPIE_FRAME_BEACON:
-        case IEEE80211_APPIE_FRAME_PROBE_RESP:
@@ -3082 +3095 @@
-                return -EINVAL;
-        }
-
-
+
+
+
+
+
-}
-
-static int
@@ -4820 +4837 @@
-#define IW_PRIV_TYPE_CHANINFO \
-        IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_chaninfo)
-#define IW_PRIV_TYPE_APPIEBUF \
-IEEE80211_APPIE_MAX
+(sizeof(struct ieee80211req_getset_appiebuf) + IEEE80211_APPIE_MAX)
-#define IW_PRIV_TYPE_FILTER \
-        IW_PRIV_TYPE_BYTE | sizeof(struct ieee80211req_set_filter)
-