Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c9fc93b authored by Felix Fietkau's avatar Felix Fietkau Committed by Johannes Berg
Browse files

mac80211/minstrel: fix NULL pointer dereference issue 



When priv_sta == NULL, mi->prev_sample is dereferenced too early. Move
the assignment further down, after the rate_control_send_low call.

Reported-by: default avatarKrzysztof Mazur <krzysiek@podlesie.net>
Cc: stable@vger.kernel.org # 3.10
Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 6b0f3274

net/mac80211/rc80211_minstrel.c

+2 −1
Original line number Diff line number Diff line
@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, 
	struct minstrel_rate *msr, *mr;

	unsigned int ndx;

	bool mrr_capable;

	bool prev_sample = mi->prev_sample;

	bool prev_sample;

	int delta;

	int sampling_ratio;
@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, 
			(mi->sample_count + mi->sample_deferred / 2);



	/* delta < 0: no sampling required */

	prev_sample = mi->prev_sample;

	mi->prev_sample = false;

	if (delta < 0 || (!mrr_capable && prev_sample))

		return;