Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input

[karo-tx-linux.git] / net / wireless / wext.c

diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 5b4a0cee4418543a3f034821b32c022c03a34e0c..60fe57761ca94bb5d9faf0638c00d373618301e2 100644 (file)
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -470,7 +470,7 @@ static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
 /*
  * Get statistics out of the driver
  */
-static struct iw_statistics *get_wireless_stats(struct net_device *dev)
+struct iw_statistics *get_wireless_stats(struct net_device *dev)
 {
        /* New location */
        if ((dev->wireless_handlers != NULL) &&
@@ -773,10 +773,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                        essid_compat = 1;
                else if (IW_IS_SET(cmd) && (iwp->length != 0)) {
                        char essid[IW_ESSID_MAX_SIZE + 1];
+                       unsigned int len;
+                       len = iwp->length * descr->token_size;
 
-                       err = copy_from_user(essid, iwp->pointer,
-                                            iwp->length *
-                                            descr->token_size);
+                       if (len > IW_ESSID_MAX_SIZE)
+                               return -EFAULT;
+
+                       err = copy_from_user(essid, iwp->pointer, len);
                        if (err)
                                return -EFAULT;