[PATCHv3] mac80211: fix NULL pointer dereference in ieee80211_compatible_rates

[PATCHv3] mac80211: fix NULL pointer dereference in ieee80211_compatible_rates

[Helmut Schaa]

Fix a possible NULL pointer dereference in ieee80211_compatible_rates 
introduced in the patch "mac80211: fix association with some APs". If no bss
is available just use all supported rates in the association request.

Signed-off-by: Helmut Schaa <hschaa@suse.de>
---

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 76ad4ed..277bbda 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -722,6 +722,10 @@ static void ieee80211_send_assoc(struct net_device *dev,
 		if (bss->wmm_ie)
 			wmm = 1;
 		ieee80211_rx_bss_put(dev, bss);
+		rates_len = ieee80211_compatible_rates(bss, sband, &rates);
+	} else {
+		rates = ~0;
+		rates_len = sband->n_bitrates;
 	}
 
 	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
@@ -755,7 +759,6 @@ static void ieee80211_send_assoc(struct net_device *dev,
 	/* all supported rates should be added here but some APs
 	 * (e.g. D-Link DAP 1353 in b-only mode) don't like that
 	 * Therefore only add rates the AP supports */
-	rates_len = ieee80211_compatible_rates(bss, sband, &rates);
 	supp_rates_len = rates_len;
 	if (supp_rates_len > 8)
 		supp_rates_len = 8;

Re: [PATCHv3] mac80211: fix NULL pointer dereference in ieee80211_compatible_rates

[Johannes Berg]

[-- Attachment #1: Type: text/plain, Size: 721 bytes --]


> +		rates_len = ieee80211_compatible_rates(bss, sband, &rates);
> +	} else {
> +		rates = ~0;
> +		rates_len = sband->n_bitrates;
>  	}
>  
>  	mgmt = (struct ieee80211_mgmt *) skb_put(skb, 24);
> @@ -755,7 +759,6 @@ static void ieee80211_send_assoc(struct net_device *dev,
>  	/* all supported rates should be added here but some APs
>  	 * (e.g. D-Link DAP 1353 in b-only mode) don't like that
>  	 * Therefore only add rates the AP supports */
> -	rates_len = ieee80211_compatible_rates(bss, sband, &rates);

Mind moving/rewriting the comment to indicate that at the place below
the rates are added, but putting the comment about the compatibility
thing to where the function is called?

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]