[PATCH 2.6.36] ath5k: check return value of ieee80211_get_tx_rate

[PATCH 2.6.36] ath5k: check return value of ieee80211_get_tx_rate

[John W. Linville]

This avoids a NULL pointer dereference as reported here:

	https://bugzilla.redhat.com/show_bug.cgi?id=625889

When the WARN condition is hit in ieee80211_get_tx_rate, it will return
NULL.  So, we need to check the return value and avoid dereferencing it
in that case.

Signed-off-by: John W. Linville <linville@tuxdriver.com>
Cc: stable@kernel.org
---
Of course, the better question is why are we hitting that condition at
all...?

 drivers/net/wireless/ath/ath5k/base.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 373dcfe..c7720e4 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1327,6 +1327,8 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
 			PCI_DMA_TODEVICE);
 
 	rate = ieee80211_get_tx_rate(sc->hw, info);
+	if (!rate)
+		goto err_unmap;
 
 	if (info->flags & IEEE80211_TX_CTL_NO_ACK)
 		flags |= AR5K_TXDESC_NOACK;
-- 
1.7.2.1

Re: [PATCH 2.6.36] ath5k: check return value of ieee80211_get_tx_rate

[Bob Copeland]

On Tue, Aug 24, 2010 at 3:27 PM, John W. Linville
<linville@tuxdriver.com> wrote:
> This avoids a NULL pointer dereference as reported here:
>
>        https://bugzilla.redhat.com/show_bug.cgi?id=625889
>
> When the WARN condition is hit in ieee80211_get_tx_rate, it will return
> NULL.  So, we need to check the return value and avoid dereferencing it
> in that case.

Yeah, it's ok with me, but get_tx_rate returning NULL always bugged me.
We could also make mac80211 return rate_lowest_index() here, perhaps?

> Of course, the better question is why are we hitting that condition at
> all...?

Some rate controller decided to stuff -1 in the rate set... no idea
why.

-- 
Bob Copeland %% www.bobcopeland.com

Re: [PATCH 2.6.36] ath5k: check return value of ieee80211_get_tx_rate

[John W. Linville]

On Tue, Aug 24, 2010 at 05:38:21PM -0400, Bob Copeland wrote:
> On Tue, Aug 24, 2010 at 3:27 PM, John W. Linville
> <linville@tuxdriver.com> wrote:
> > This avoids a NULL pointer dereference as reported here:
> >
> >        https://bugzilla.redhat.com/show_bug.cgi?id=625889
> >
> > When the WARN condition is hit in ieee80211_get_tx_rate, it will return
> > NULL.  So, we need to check the return value and avoid dereferencing it
> > in that case.
> 
> Yeah, it's ok with me, but get_tx_rate returning NULL always bugged me.
> We could also make mac80211 return rate_lowest_index() here, perhaps?

Yeah, I was considering that as an alternative.

> > Of course, the better question is why are we hitting that condition at
> > all...?
> 
> Some rate controller decided to stuff -1 in the rate set... no idea
> why.

Well, I got that part already... :-)

John
-- 
John W. Linville		Someday the world will need a hero, and you
linville@tuxdriver.com			might be all we have.  Be ready.