Commit 390fd9d6 authored by Christian Lamparter's avatar Christian Lamparter Committed by John W. Linville

p54: fix off-by-one null pointer bug in p54_tx_80211

This patch fixes a regression which was introduced in:
"mac80211: move TX station pointer and restructure TX"

IP: p54_tx_80211+0x21/0x513 [p54common]
Oops: 0000 [#1] SMP
Modules linked in: p54usb p54common [...]
Pid: 13394, comm: hostapd 3.6.0-rc4-wl+
RIP: 0010:p54_tx_80211+0x21/0x513
RSP: 0018:...  EFLAGS: 00010292
[...]
Process hostapd
Stack:
[...]
Call Trace:
p54_bss_info_changed+0x204/0x21e [p54common]
ieee80211_del_station+0x16/0x32 [mac80211]
ieee80211_start_ap+0x10f/0x157 [mac80211]
nl80211_start_ap+0x315/0x361 [cfg80211]

p54_tx_80211 function is called as part of the
beacon update. The caller p54_bss_info_changed
has to supply a valid tx control struct, or
the control->sta will lead to a null pointer
dereference.
Signed-off-by: default avatarChristian Lamparter <chunkeey@googlemail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 28ab58bd
...@@ -139,6 +139,7 @@ static int p54_beacon_format_ie_tim(struct sk_buff *skb) ...@@ -139,6 +139,7 @@ static int p54_beacon_format_ie_tim(struct sk_buff *skb)
static int p54_beacon_update(struct p54_common *priv, static int p54_beacon_update(struct p54_common *priv,
struct ieee80211_vif *vif) struct ieee80211_vif *vif)
{ {
struct ieee80211_tx_control control = { };
struct sk_buff *beacon; struct sk_buff *beacon;
int ret; int ret;
...@@ -158,7 +159,7 @@ static int p54_beacon_update(struct p54_common *priv, ...@@ -158,7 +159,7 @@ static int p54_beacon_update(struct p54_common *priv,
* to cancel the old beacon template by hand, instead the firmware * to cancel the old beacon template by hand, instead the firmware
* will release the previous one through the feedback mechanism. * will release the previous one through the feedback mechanism.
*/ */
p54_tx_80211(priv->hw, NULL, beacon); p54_tx_80211(priv->hw, &control, beacon);
priv->tsf_high32 = 0; priv->tsf_high32 = 0;
priv->tsf_low32 = 0; priv->tsf_low32 = 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment