Obviously this is a very old patch, but I was just looking at users of
cfg80211_find_vendor_ie() and realized you have a bug here:
> + vendor_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
> + WLAN_OUI_TYPE_MICROSOFT_
> WMM,
> + params->beacon.tail,
> + params-
> >beacon.tail_len);
> + if (vendor_ie) {
> + wmm_ie = (struct ieee_types_header *)vendor_ie;
> + memcpy(&bss_cfg->wmm_info, wmm_ie + 1,
> + sizeof(bss_cfg->wmm_info));
> + priv->wmm_enabled = 1;
You need to check that the vendor_ie is actually long enough.
johannes
