[PATCH] mac80211: Fix NULL-pointer deference on ibss merge when not ready

[PATCH] mac80211: Fix NULL-pointer deference on ibss merge when not ready

[Tim Harvey]

dev_open will eventually call ieee80211_ibss_join which sets up the
skb used for beacons/probe-responses however it is possible to
receive beacons that attempt to merge before this occurs causing
a null pointer dereference.

This occurs quite easily in the presence of adhoc nodes with hidden SSID's
---
 net/mac80211/ibss.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 410d104..24e2482 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -86,6 +86,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 	drv_reset_tsf(local);
 
 	skb = ifibss->skb;
+	if (!skb)
+		return; /* not ready to merge yet */
 	rcu_assign_pointer(ifibss->presp, NULL);
 	synchronize_rcu();
 	skb->data = skb->head;
-- 
1.7.0.4

Re: [PATCH] mac80211: Fix NULL-pointer deference on ibss merge when not ready

[John W. Linville]

On Thu, Dec 09, 2010 at 08:43:59AM -0800, Tim Harvey wrote:
> dev_open will eventually call ieee80211_ibss_join which sets up the
> skb used for beacons/probe-responses however it is possible to
> receive beacons that attempt to merge before this occurs causing
> a null pointer dereference.
> 
> This occurs quite easily in the presence of adhoc nodes with hidden SSID's
> ---
>  net/mac80211/ibss.c |    2 ++
>  1 files changed, 2 insertions(+), 0 deletions(-)

Signed-off-by?

-- 
John W. Linville		Someday the world will need a hero, and you
linville@tuxdriver.com			might be all we have.  Be ready.