Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a401d2bb authored Jul 20, 2011 by Johannes Berg Committed by John W. Linville Jul 20, 2011

cfg80211: fix scan crash on single-band cards



commit 58389c69150e6032504dfcd3edca6b1975c8b5bc
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Mon Jul 18 18:08:35 2011 +0200

     cfg80211: allow userspace to control supported rates in scan

made single-band cards crash since it would always
access all wiphy->bands[]. Fix this and reject any
attempts in the new helper ieee80211_get_ratemask()
to do the same, rejecting rates configuration for
unsupported bands.

Reported-by: Pavel Roskin <proski@gnu.org>
Tested-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent 70126f61

net/wireless/nl80211.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -3454,7 +3454,9 @@ static int nl80211_trigger_scan(struct sk_buff skb, struct genl_info info)
	}		}

	for (i = 0; i < IEEE80211_NUM_BANDS; i++)		for (i = 0; i < IEEE80211_NUM_BANDS; i++)
	request->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;		if (wiphy->bands[i])
			request->rates[i] =
			(1 << wiphy->bands[i]->n_bitrates) - 1;

	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {		if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
	nla_for_each_nested(attr,		nla_for_each_nested(attr,

net/wireless/scan.c

+2 −1

Original line number	Original line	Diff line number	Diff line
	@@ -863,6 +863,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
	}		}

	for (i = 0; i < IEEE80211_NUM_BANDS; i++)		for (i = 0; i < IEEE80211_NUM_BANDS; i++)
			if (wiphy->bands[i])
	creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;		creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;

	rdev->scan_req = creq;		rdev->scan_req = creq;

net/wireless/util.c

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1013,6 +1013,9 @@ int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
	{		{
	int i, j;		int i, j;

			if (!sband)
			return -EINVAL;

	if (n_rates == 0 \|\| n_rates > NL80211_MAX_SUPP_RATES)		if (n_rates == 0 \|\| n_rates > NL80211_MAX_SUPP_RATES)
	return -EINVAL;		return -EINVAL;