* [PATCH] cfg80211:: fix possible NULL pointer dereference
@ 2011-03-26 18:26 Mariusz Kozlowski
2011-03-27 9:18 ` Johannes Berg
0 siblings, 1 reply; 2+ messages in thread
From: Mariusz Kozlowski @ 2011-03-26 18:26 UTC (permalink / raw)
To: Johannes Berg
Cc: John W. Linville, David S. Miller, linux-wireless, netdev,
linux-kernel, Mariusz Kozlowski
In cfg80211_inform_bss_frame() wiphy is first dereferenced on privsz
initialisation and then it is checked for NULL. This patch fixes that.
Signed-off-by: Mariusz Kozlowski <mk@lab.zgora.pl>
---
net/wireless/scan.c | 13 ++++++++++---
1 files changed, 10 insertions(+), 3 deletions(-)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index ea427f4..300c11d 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -585,16 +585,23 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy,
struct cfg80211_internal_bss *res;
size_t ielen = len - offsetof(struct ieee80211_mgmt,
u.probe_resp.variable);
- size_t privsz = wiphy->bss_priv_size;
+ size_t privsz;
+
+ if (WARN_ON(!mgmt))
+ return NULL;
+
+ if (WARN_ON(!wiphy))
+ return NULL;
if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&
(signal < 0 || signal > 100)))
return NULL;
- if (WARN_ON(!mgmt || !wiphy ||
- len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
+ if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))
return NULL;
+ privsz = wiphy->bss_priv_size;
+
res = kzalloc(sizeof(*res) + privsz + ielen, gfp);
if (!res)
return NULL;
--
1.7.0.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] cfg80211:: fix possible NULL pointer dereference
2011-03-26 18:26 [PATCH] cfg80211:: fix possible NULL pointer dereference Mariusz Kozlowski
@ 2011-03-27 9:18 ` Johannes Berg
0 siblings, 0 replies; 2+ messages in thread
From: Johannes Berg @ 2011-03-27 9:18 UTC (permalink / raw)
To: Mariusz Kozlowski
Cc: John W. Linville, David S. Miller, linux-wireless, netdev,
linux-kernel
On Sat, 2011-03-26 at 19:26 +0100, Mariusz Kozlowski wrote:
> In cfg80211_inform_bss_frame() wiphy is first dereferenced on privsz
> initialisation and then it is checked for NULL. This patch fixes that.
>
> Signed-off-by: Mariusz Kozlowski <mk@lab.zgora.pl>
Acked-by: Johannes Berg <johannes@sipsolutions.net>
Thanks!
johannes
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-03-27 9:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-26 18:26 [PATCH] cfg80211:: fix possible NULL pointer dereference Mariusz Kozlowski
2011-03-27 9:18 ` Johannes Berg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).