From: Stanislaw Gruszka <sgruszka@redhat.com>
Date: Fri, 16 Apr 2010 13:46:41 +0000 (+0200)
Subject: iwlwifi: check scan request ie_len
X-Git-Tag: v2.6.35-rc1~473^2~393^2~27
X-Git-Url: http://bbs.cooldavid.org/git/?a=commitdiff_plain;h=eb2ec0fb3c2fe85d42b2d5131e526daa0e298b9e;p=net-next-2.6.git

iwlwifi: check scan request ie_len

In mac80211 we always check both scan_req->ie and scan_req->ie_len
against zero before usage, in iwlwifi we should do the same.

Remove not needed "left -= ie_len" while at it.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Acked-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
---

diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index d817c9c184a..83e62917e0b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -644,10 +644,10 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
 	if (WARN_ON(left < ie_len))
 		return len;
 
-	if (ies)
+	if (ies && ie_len) {
 		memcpy(pos, ies, ie_len);
-	len += ie_len;
-	left -= ie_len;
+		len += ie_len;
+	}
 
 	return (u16)len;
 }