Commit 66870b1c authored by Luciano Coelho's avatar Luciano Coelho Committed by John W. Linville

wl12xx: fix oops in sched_scan when forcing a passive scan

Fix kernel oops when trying to use passive scheduled scans.  The
reason was that in passive scans there are no SSIDs, so there was a
NULL pointer dereference.

To solve the problem, we now check the number of SSIDs provided in the
sched_scan request and only access the list if there's one or more
(ie. passive scan is not forced).  We also force all the channels to
be passive by adding the IEEE80211_CHAN_PASSIVE_SCAN flag locally
before the checks in the wl1271_scan_get_sched_scan_channels()
function.
Signed-off-by: default avatarLuciano Coelho <coelho@ti.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 50a66d7f
...@@ -331,12 +331,16 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl, ...@@ -331,12 +331,16 @@ wl1271_scan_get_sched_scan_channels(struct wl1271 *wl,
struct conf_sched_scan_settings *c = &wl->conf.sched_scan; struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
int i, j; int i, j;
u32 flags; u32 flags;
bool force_passive = !req->n_ssids;
for (i = 0, j = start; for (i = 0, j = start;
i < req->n_channels && j < MAX_CHANNELS_ALL_BANDS; i < req->n_channels && j < MAX_CHANNELS_ALL_BANDS;
i++) { i++) {
flags = req->channels[i]->flags; flags = req->channels[i]->flags;
if (force_passive)
flags |= IEEE80211_CHAN_PASSIVE_SCAN;
if ((req->channels[i]->band == band) && if ((req->channels[i]->band == band) &&
!(flags & IEEE80211_CHAN_DISABLED) && !(flags & IEEE80211_CHAN_DISABLED) &&
(!!(flags & IEEE80211_CHAN_RADAR) == radar) && (!!(flags & IEEE80211_CHAN_RADAR) == radar) &&
...@@ -433,6 +437,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl, ...@@ -433,6 +437,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
struct wl1271_cmd_sched_scan_config *cfg = NULL; struct wl1271_cmd_sched_scan_config *cfg = NULL;
struct conf_sched_scan_settings *c = &wl->conf.sched_scan; struct conf_sched_scan_settings *c = &wl->conf.sched_scan;
int i, total_channels, ret; int i, total_channels, ret;
bool force_passive = !req->n_ssids;
wl1271_debug(DEBUG_CMD, "cmd sched_scan scan config"); wl1271_debug(DEBUG_CMD, "cmd sched_scan scan config");
...@@ -456,7 +461,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl, ...@@ -456,7 +461,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
for (i = 0; i < SCAN_MAX_CYCLE_INTERVALS; i++) for (i = 0; i < SCAN_MAX_CYCLE_INTERVALS; i++)
cfg->intervals[i] = cpu_to_le32(req->interval); cfg->intervals[i] = cpu_to_le32(req->interval);
if (req->ssids[0].ssid_len && req->ssids[0].ssid) { if (!force_passive && req->ssids[0].ssid_len && req->ssids[0].ssid) {
cfg->filter_type = SCAN_SSID_FILTER_SPECIFIC; cfg->filter_type = SCAN_SSID_FILTER_SPECIFIC;
cfg->ssid_len = req->ssids[0].ssid_len; cfg->ssid_len = req->ssids[0].ssid_len;
memcpy(cfg->ssid, req->ssids[0].ssid, memcpy(cfg->ssid, req->ssids[0].ssid,
...@@ -473,7 +478,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl, ...@@ -473,7 +478,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
goto out; goto out;
} }
if (cfg->active[0]) { if (!force_passive && cfg->active[0]) {
ret = wl1271_cmd_build_probe_req(wl, req->ssids[0].ssid, ret = wl1271_cmd_build_probe_req(wl, req->ssids[0].ssid,
req->ssids[0].ssid_len, req->ssids[0].ssid_len,
ies->ie[IEEE80211_BAND_2GHZ], ies->ie[IEEE80211_BAND_2GHZ],
...@@ -485,7 +490,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl, ...@@ -485,7 +490,7 @@ int wl1271_scan_sched_scan_config(struct wl1271 *wl,
} }
} }
if (cfg->active[1]) { if (!force_passive && cfg->active[1]) {
ret = wl1271_cmd_build_probe_req(wl, req->ssids[0].ssid, ret = wl1271_cmd_build_probe_req(wl, req->ssids[0].ssid,
req->ssids[0].ssid_len, req->ssids[0].ssid_len,
ies->ie[IEEE80211_BAND_5GHZ], ies->ie[IEEE80211_BAND_5GHZ],
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment