Update compat-wireless to 2.6.36-5-spn

chromeos/compat-wireless/net/wireless/wext-core.c

 /*
  * This file implement the Wireless Extensions core API.
  *
  * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
  * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
  * Copyright    2009 Johannes Berg <johannes@sipsolutions.net>
  *
  * (As all part of the Linux kernel, this file is GPL)
  */
 #include <linux/kernel.h>
@@ skipping 797 matching lines @@
                 }
 
                 if (cmd == SIOCSIWENCODEEXT) {
                         struct iw_encode_ext *ee = (void *) extra;
 
                         if (iwp->length < sizeof(*ee) + ee->key_len)
                                 return -EFAULT;
                 }
         }
 
+        if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
+                /*
+                 * If this is a GET, but not NOMAX, it means that the extra
+                 * data is not bounded by userspace, but by max_tokens. Thus
+                 * set the length to max_tokens. This matches the extra data
+                 * allocation.
+                 * The driver should fill it with the number of tokens it
+                 * provided, and it may check iwp->length rather than having
+                 * knowledge of max_tokens. If the driver doesn't change the
+                 * iwp->length, this ioctl just copies back max_token tokens
+                 * filled with zeroes. Hopefully the driver isn't claiming
+                 * them to be valid data.
+                 */
+                iwp->length = descr->max_tokens;
+        }
+
         err = handler(dev, info, (union iwreq_data *) iwp, extra);
 
         iwp->length += essid_compat;
 
         /* If we have something to return to the user */
         if (!err && IW_IS_GET(cmd)) {
                 /* Check if there is enough buffer up there */
                 if (user_length < iwp->length) {
                         err = -E2BIG;
                         goto out;
@@ skipping 267 matching lines @@
                                   compat_private_call);
 
         if (ret >= 0 &&
             IW_IS_GET(cmd) &&
             copy_to_user(argp, &iwr, sizeof(struct iwreq)))
                 return -EFAULT;
 
         return ret;
 }
 #endif