sotftmac: fix a slab corruption in WEP restricted key association

Fix a slab corruption in ieee80211softmac_auth(). The size of a buffer was miscomputed.

see http://bugzilla.kernel.org/show_bug.cgi?id=7245

Acked-by Daniel Drake <[email protected]>"

Signed-off-by Laurent Riffard <[email protected]>

net/ieee80211/softmac/ieee80211softmac_io.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

Index: linux-2.6-mm/net/ieee80211/softmac/ieee80211softmac_io.c
===================================================================

net/ieee80211/softmac/ieee80211softmac_io.c +1 -1

@@ -304,7 +304,7 @@ ieee80211softmac_auth(struct ieee80211_a
        2 +        /* Auth Transaction Seq */
        2 +        /* Status Code */
         /* Challenge Text IE */
-        is_shared_response ? 0 : 1 + 1 + net->challenge_len
+        (is_shared_response ? 1 + 1 + net->challenge_len : 0)
    );
    if (unlikely((*pkt) == NULL))
        return 0;

Review

Quoted 2 lines

(quoted diff) +1 -1

-        is_shared_response ? 0 : 1 + 1 + net->challenge_len
+        (is_shared_response ? 1 + 1 + net->challenge_len : 0)

Good catch. We should send this to -stable too I think. Mind reposting the patch in an applicable format to Daniel, netdev, john, -stable (and possibly me)? Quoted isn't too useful :)

Quoted 3 lines · Johannes Berg

Good catch. We should send this to -stable too I think. Mind reposting the patch in an applicable format to Daniel, netdev, john, -stable (and possibly me)? Quoted isn't too useful :)

It was already sent to John directly. I was planning on sending it to -stable as soon as it hits Linus' tree.