diff options
| author | Tim Harvey <harvey.tim@gmail.com> | 2010-12-09 10:43:13 -0800 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-12-13 14:53:46 -0500 |
| commit | c926d006c1514cfb3572893f41f2324e96823661 (patch) | |
| tree | b76f1ac5f172f7a5ee47da767cdc31bd4e164e32 /net | |
| parent | 4a55d5852adbe66722fb1636c82c7864cd5be441 (diff) | |
| download | linux-3.10-c926d006c1514cfb3572893f41f2324e96823661.tar.gz linux-3.10-c926d006c1514cfb3572893f41f2324e96823661.tar.bz2 linux-3.10-c926d006c1514cfb3572893f41f2324e96823661.zip | |
mac80211: Fix NULL-pointer deference on ibss merge when not ready
dev_open will eventually call ieee80211_ibss_join which sets up the
skb used for beacons/probe-responses however it is possible to
receive beacons that attempt to merge before this occurs causing
a null pointer dereference. Check ssid_len as that is the last
thing set in ieee80211_ibss_join.
This occurs quite easily in the presence of adhoc nodes with hidden SSID's
revised previous patch to check further up based on irc feedback
Signed-off-by: Tim Harvey <harvey.tim@gmail.com>
Reviewed-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mac80211/ibss.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c index 239c4836a94..077a93dd167 100644 --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -780,6 +780,9 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, mutex_lock(&sdata->u.ibss.mtx); + if (!sdata->u.ibss.ssid_len) + goto mgmt_out; /* not ready to merge yet */ + switch (fc & IEEE80211_FCTL_STYPE) { case IEEE80211_STYPE_PROBE_REQ: ieee80211_rx_mgmt_probe_req(sdata, mgmt, skb->len); @@ -797,6 +800,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata, break; } + mgmt_out: mutex_unlock(&sdata->u.ibss.mtx); } |