From: Wang Yan <wangyan01@kylinos.cn>
To: chunkeey@gmail.com
Cc: johannes.berg@intel.com, linux-kernel@vger.kernel.org,
linux-wireless@vger.kernel.org, linville@tuxdriver.com,
wangyan01@kylinos.cn, zilin@seu.edu.cn
Subject: [PATCH v2] wifi: p54: remove redundant length check in p54_find_ie()
Date: Mon, 7 Sep 2026 10:49:41 +0800 [thread overview]
Message-ID: <20260907024941.302630-1-wangyan01@kylinos.cn> (raw)
In-Reply-To: <bdca394f-0371-45ad-bfee-b044444ad724@gmail.com>
The check in the while loop condition and the bounds check within the
loop body guarantee that "pos" is never returned unless the IE is still
within skb->len.
Additionally, sizeof(mgmt) evaluates to the pointer size rather than
the actual management frame header size, making the check incorrect as
well.
Therefore, removing the redundant check is the right fix.
Fixes: e5ea92a7528d ("p54: AP & Ad-hoc testing")
Signed-off-by: Wang Yan <wangyan01@kylinos.cn>
---
drivers/net/wireless/intersil/p54/main.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c
index 57a62108cbc3..8f921dc4ecd3 100644
--- a/drivers/net/wireless/intersil/p54/main.c
+++ b/drivers/net/wireless/intersil/p54/main.c
@@ -76,9 +76,6 @@ u8 *p54_find_ie(struct sk_buff *skb, u8 ie)
struct ieee80211_mgmt *mgmt = (void *)skb->data;
u8 *pos, *end;
- if (skb->len <= sizeof(mgmt))
- return NULL;
-
pos = (u8 *)mgmt->u.beacon.variable;
end = skb->data + skb->len;
while (pos < end) {
--
2.25.1
next prev parent reply other threads:[~2026-09-07 2:50 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 8:12 [PATCH] wifi: p54: fix incorrect frame length check in p54_find_ie() Wang Yan
2026-09-06 11:06 ` Christian Lamparter
2026-09-06 11:49 ` Johannes Berg
2026-09-06 14:24 ` Christian Lamparter
2026-09-06 14:44 ` Johannes Berg
2026-09-07 2:49 ` Wang Yan [this message]
2026-09-07 6:19 ` [PATCH] wifi: p54: fix incorrect " Wang Yan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260907024941.302630-1-wangyan01@kylinos.cn \
--to=wangyan01@kylinos.cn \
--cc=chunkeey@gmail.com \
--cc=johannes.berg@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=zilin@seu.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.