From: Johannes Berg <johannes@sipsolutions.net>
To: John Linville <linville@tuxdriver.com>
Cc: Pavel Roskin <proski@gnu.org>,
linux-wireless <linux-wireless@vger.kernel.org>
Subject: [PATCH] cfg80211: fix scan crash on single-band cards
Date: Wed, 20 Jul 2011 00:52:16 +0200 [thread overview]
Message-ID: <1311115936.3872.3.camel@jlt3.sipsolutions.net> (raw)
From: Johannes Berg <johannes.berg@intel.com>
commit 58389c69150e6032504dfcd3edca6b1975c8b5bc
Author: Johannes Berg <johannes.berg@intel.com>
Date: Mon Jul 18 18:08:35 2011 +0200
cfg80211: allow userspace to control supported rates in scan
made single-band cards crash since it would always
access all wiphy->bands[]. Fix this and reject any
attempts in the new helper ieee80211_get_ratemask()
to do the same, rejecting rates configuration for
unsupported bands.
Reported-by: Pavel Roskin <proski@gnu.org>
Tested-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
---
net/wireless/nl80211.c | 4 +++-
net/wireless/scan.c | 3 ++-
net/wireless/util.c | 3 +++
3 files changed, 8 insertions(+), 2 deletions(-)
--- a/net/wireless/nl80211.c 2011-07-20 00:50:57.000000000 +0200
+++ b/net/wireless/nl80211.c 2011-07-20 00:51:00.000000000 +0200
@@ -3454,7 +3454,9 @@ static int nl80211_trigger_scan(struct s
}
for (i = 0; i < IEEE80211_NUM_BANDS; i++)
- request->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
+ if (wiphy->bands[i])
+ request->rates[i] =
+ (1 << wiphy->bands[i]->n_bitrates) - 1;
if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
nla_for_each_nested(attr,
--- a/net/wireless/scan.c 2011-07-20 00:50:57.000000000 +0200
+++ b/net/wireless/scan.c 2011-07-20 00:51:00.000000000 +0200
@@ -864,7 +864,8 @@ int cfg80211_wext_siwscan(struct net_dev
}
for (i = 0; i < IEEE80211_NUM_BANDS; i++)
- creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
+ if (wiphy->bands[i])
+ creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
rdev->scan_req = creq;
err = rdev->ops->scan(wiphy, dev, creq);
--- a/net/wireless/util.c 2011-07-20 00:50:57.000000000 +0200
+++ b/net/wireless/util.c 2011-07-20 00:51:00.000000000 +0200
@@ -1013,6 +1013,9 @@ int ieee80211_get_ratemask(struct ieee80
{
int i, j;
+ if (!sband)
+ return -EINVAL;
+
if (n_rates == 0 || n_rates > NL80211_MAX_SUPP_RATES)
return -EINVAL;
next reply other threads:[~2011-07-19 22:52 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-07-19 22:52 Johannes Berg [this message]
2011-07-20 17:00 ` [PATCH] cfg80211: fix scan crash on single-band cards Rafał Miłecki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1311115936.3872.3.camel@jlt3.sipsolutions.net \
--to=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=proski@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).