mwifiex: fix invalid HT IE configuration in FW

This patch fixes an issue where it was discovered that driver is setting
invalid HT IEs to FW. This was happening because bug in parsing HT IE.
Driver would incorrectly point to start of HT IE while FW only needs actual
HT configuration - excluding EID and length.

Signed-off-by: Zhaoyang Liu <liuzy@marvell.com>
Signed-off-by: Avinash Patil <patila@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index f5c2af01ba0a96c707edb76760d945154ddb30f2..3d0281190b9dc817eefbddc9ca13550c08147135 100644 (file)
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -167,7 +167,7 @@ mwifiex_set_ht_params(struct mwifiex_private *priv,
        ht_ie = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, params->beacon.tail,
                                 params->beacon.tail_len);
        if (ht_ie) {
-               memcpy(&bss_cfg->ht_cap, ht_ie,
+               memcpy(&bss_cfg->ht_cap, ht_ie + 2,
                       sizeof(struct ieee80211_ht_cap));
                cap_info = le16_to_cpu(bss_cfg->ht_cap.cap_info);
                memset(&bss_cfg->ht_cap.mcs, 0,

diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index b8a45872354d7f46c330da734fa5f2aef8b4c7c0..9482d955c3844daa5570ed09a8c5604b9fa7a4ea 100644 (file)
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -536,13 +536,16 @@ void
 mwifiex_set_sta_ht_cap(struct mwifiex_private *priv, const u8 *ies,
                       int ies_len, struct mwifiex_sta_node *node)
 {
+       struct ieee_types_header *ht_cap_ie;
        const struct ieee80211_ht_cap *ht_cap;
 
        if (!ies)
                return;
 
-       ht_cap = (void *)cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
-       if (ht_cap) {
+       ht_cap_ie = (void *)cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies,
+                                            ies_len);
+       if (ht_cap_ie) {
+               ht_cap = (void *)(ht_cap_ie + 1);
                node->is_11n_enabled = 1;
                node->max_amsdu = le16_to_cpu(ht_cap->cap_info) &
                                  IEEE80211_HT_CAP_MAX_AMSDU ?