From 62b09954d2865ab3255916699b7e34961c99b91f Mon Sep 17 00:00:00 2001
From: Johannes Berg <johannes.berg@intel.com>
Date: Mon, 30 Aug 2010 12:24:54 +0200
Subject: [PATCH] --- yaml --- r: 210255 b: refs/heads/master c:
 42da2f948d949efd0111309f5827bf0298bcc9a4 h: refs/heads/master i:   210253:
 b02ef57b5a502d7c78582347e1f2e73d779c1f66   210251:
 d7a36ddff9d179f90b05226be694cd99424493a7   210247:
 f6b34d8308e50e1425b88a92bc7cce5d8f098121   210239:
 f17f6d3d6d72d2d415d6b1ac32e2392ed9e53a14 v: v3

---
 [refs]                           |  2 +-
 trunk/net/wireless/wext-compat.c |  3 +++
 trunk/net/wireless/wext-core.c   | 16 ++++++++++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index f3e0d4cb5150..d806ffe8e6d4 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 9ef808048564928a83f3a52c65c5725688cf5cbe
+refs/heads/master: 42da2f948d949efd0111309f5827bf0298bcc9a4
diff --git a/trunk/net/wireless/wext-compat.c b/trunk/net/wireless/wext-compat.c
index bb5e0a5ecfa1..7e5c3a45f811 100644
--- a/trunk/net/wireless/wext-compat.c
+++ b/trunk/net/wireless/wext-compat.c
@@ -1420,6 +1420,9 @@ int cfg80211_wext_giwessid(struct net_device *dev,
 {
 	struct wireless_dev *wdev = dev->ieee80211_ptr;
 
+	data->flags = 0;
+	data->length = 0;
+
 	switch (wdev->iftype) {
 	case NL80211_IFTYPE_ADHOC:
 		return cfg80211_ibss_wext_giwessid(dev, info, data, ssid);
diff --git a/trunk/net/wireless/wext-core.c b/trunk/net/wireless/wext-core.c
index 0ef17bc42bac..8f5116f5af19 100644
--- a/trunk/net/wireless/wext-core.c
+++ b/trunk/net/wireless/wext-core.c
@@ -782,6 +782,22 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
 		}
 	}
 
+	if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
+		/*
+		 * If this is a GET, but not NOMAX, it means that the extra
+		 * data is not bounded by userspace, but by max_tokens. Thus
+		 * set the length to max_tokens. This matches the extra data
+		 * allocation.
+		 * The driver should fill it with the number of tokens it
+		 * provided, and it may check iwp->length rather than having
+		 * knowledge of max_tokens. If the driver doesn't change the
+		 * iwp->length, this ioctl just copies back max_token tokens
+		 * filled with zeroes. Hopefully the driver isn't claiming
+		 * them to be valid data.
+		 */
+		iwp->length = descr->max_tokens;
+	}
+
 	err = handler(dev, info, (union iwreq_data *) iwp, extra);
 
 	iwp->length += essid_compat;