Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bef9bacc authored by Mariusz Kozlowski's avatar Mariusz Kozlowski Committed by John W. Linville
Browse files

cfg80211:: fix possible NULL pointer dereference 



In cfg80211_inform_bss_frame() wiphy is first dereferenced on privsz
initialisation and then it is checked for NULL. This patch fixes that.

Signed-off-by: default avatarMariusz Kozlowski <mk@lab.zgora.pl>
Acked-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 67aa030c

net/wireless/scan.c

+10 −3
Original line number Diff line number Diff line
@@ -585,16 +585,23 @@ cfg80211_inform_bss_frame(struct wiphy *wiphy, 
	struct cfg80211_internal_bss *res;

	size_t ielen = len - offsetof(struct ieee80211_mgmt,

				      u.probe_resp.variable);

	size_t privsz = wiphy->bss_priv_size;

	size_t privsz;



	if (WARN_ON(!mgmt))

		return NULL;



	if (WARN_ON(!wiphy))

		return NULL;



	if (WARN_ON(wiphy->signal_type == CFG80211_SIGNAL_TYPE_UNSPEC &&

	            (signal < 0 || signal > 100)))

		return NULL;



	if (WARN_ON(!mgmt || !wiphy ||

		    len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))

	if (WARN_ON(len < offsetof(struct ieee80211_mgmt, u.probe_resp.variable)))

		return NULL;



	privsz = wiphy->bss_priv_size;



	res = kzalloc(sizeof(*res) + privsz + ielen, gfp);

	if (!res)

		return NULL;