Commit 44e1b98f authored by Michael Buesch's avatar Michael Buesch Committed by John W. Linville
Browse files

cfg80211: Use the correct IE buffer pointer

If the IE buffer was allocated, the pub.information_elements pointer
was also changed to the allocated space. So we must not assume anymore
that the pointer points at the "found" tail.

So if it was allocated previously, take the codebranch that grows the
buffer size (if necessary) and put the data into the allocated buffer.
Signed-off-by: default avatarMichael Buesch <>
Acked-by: default avatarJohannes Berg <>
Signed-off-by: default avatarJohn W. Linville <>
parent 273de92c
...@@ -377,7 +377,7 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev, ...@@ -377,7 +377,7 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
size_t used = dev->wiphy.bss_priv_size + sizeof(*res); size_t used = dev->wiphy.bss_priv_size + sizeof(*res);
size_t ielen = res->pub.len_information_elements; size_t ielen = res->pub.len_information_elements;
if (ksize(found) >= used + ielen) { if (!found->ies_allocated && ksize(found) >= used + ielen) {
memcpy(found->pub.information_elements, memcpy(found->pub.information_elements,
res->pub.information_elements, ielen); res->pub.information_elements, ielen);
found->pub.len_information_elements = ielen; found->pub.len_information_elements = ielen;
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment