aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorDavid Woo <xinhua_wu@realsil.com.cn>2009-08-12 11:03:44 -0700
committerJohn W. Linville <linville@tuxdriver.com>2009-08-14 09:14:06 -0400
commit70bdb6b275d789ddf05c3a858e6b57715539394b (patch)
tree35667ac24fcbc9c6efc3ade446d8571d3c34a1fe /net
parent57ef5ddb456649667438e023f67dd3a3ff3fbed8 (diff)
downloadkernel_samsung_tuna-70bdb6b275d789ddf05c3a858e6b57715539394b.zip
kernel_samsung_tuna-70bdb6b275d789ddf05c3a858e6b57715539394b.tar.gz
kernel_samsung_tuna-70bdb6b275d789ddf05c3a858e6b57715539394b.tar.bz2
mac80211: Fix invalid length passed to IE parser for PLINK CONFIRM frames
The length of the fixed portion of plink confirm frames is 4 bytes longer than the other plink_action frames. This path corrects an error in the length adjustment done for these type of frames. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net')
-rw-r--r--net/mac80211/mesh_plink.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index cb14253..ffcbad7 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -409,7 +409,7 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata, struct ieee80211_m
baselen = (u8 *) mgmt->u.action.u.plink_action.variable - (u8 *) mgmt;
if (mgmt->u.action.u.plink_action.action_code == PLINK_CONFIRM) {
baseaddr += 4;
- baselen -= 4;
+ baselen += 4;
}
ieee802_11_parse_elems(baseaddr, len - baselen, &elems);
if (!elems.peer_link) {