From: Wang Yan <wangyan01@kylinos.cn>
To: chunkeey@googlemail.com
Cc: johannes.berg@intel.com, zilin@seu.edu.cn, wangyan01@kylinos.cn,
linville@tuxdriver.com, Larry.Finger@lwfinger.net,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] wifi: p54: fix incorrect frame length check in p54_find_ie()
Date: Thu, 3 Sep 2026 16:12:00 +0800 [thread overview]
Message-ID: <20260903081200.267514-1-wangyan01@kylinos.cn> (raw)
In p54_find_ie(), mgmt is a pointer to struct ieee80211_mgmt, so
sizeof(mgmt) evaluates to the size of the pointer rather than the size
of the management frame header.
Use sizeof(*mgmt) instead so that the skb length is compared against
the actual size of the management frame header.
Fixes: 0ac0d6cedf61 ("p54: Move mac80211 glue code")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
---
drivers/net/wireless/intersil/p54/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c
index 57a62108cbc3..d3e1776174f9 100644
--- a/drivers/net/wireless/intersil/p54/main.c
+++ b/drivers/net/wireless/intersil/p54/main.c
@@ -76,7 +76,7 @@ u8 *p54_find_ie(struct sk_buff *skb, u8 ie)
struct ieee80211_mgmt *mgmt = (void *)skb->data;
u8 *pos, *end;
- if (skb->len <= sizeof(mgmt))
+ if (skb->len <= sizeof(*mgmt))
return NULL;
pos = (u8 *)mgmt->u.beacon.variable;
--
2.25.1
next reply other threads:[~2026-09-03 8:12 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 8:12 Wang Yan [this message]
2026-09-06 11:06 ` [PATCH] wifi: p54: fix incorrect frame length check in p54_find_ie() Christian Lamparter
2026-09-06 11:49 ` Johannes Berg
2026-09-06 14:24 ` Christian Lamparter
2026-09-06 14:44 ` Johannes Berg
2026-09-07 2:49 ` [PATCH v2] wifi: p54: remove redundant " Wang Yan
2026-09-07 6:19 ` [PATCH] wifi: p54: fix incorrect " Wang Yan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260903081200.267514-1-wangyan01@kylinos.cn \
--to=wangyan01@kylinos.cn \
--cc=Larry.Finger@lwfinger.net \
--cc=chunkeey@googlemail.com \
--cc=johannes.berg@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=zilin@seu.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.