瀏覽代碼

cfg80211: fix NULL dereference in IBSS SIOCGIWAP

This patch avoids memcpy from wdev->wext.ibss.bssid if it is NULL.
This could happen if we SIOCGIWAP before SIOCSIWAP.

Signed-off-by: Zhu Yi <yi.zhu@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Zhu Yi 16 年之前
父節點
當前提交
80e5b06a1b
共有 1 個文件被更改,包括 4 次插入1 次删除
  1. 4 1
      net/wireless/ibss.c

+ 4 - 1
net/wireless/ibss.c

@@ -487,8 +487,11 @@ int cfg80211_ibss_wext_giwap(struct net_device *dev,
 	wdev_lock(wdev);
 	wdev_lock(wdev);
 	if (wdev->current_bss)
 	if (wdev->current_bss)
 		memcpy(ap_addr->sa_data, wdev->current_bss->pub.bssid, ETH_ALEN);
 		memcpy(ap_addr->sa_data, wdev->current_bss->pub.bssid, ETH_ALEN);
-	else
+	else if (wdev->wext.ibss.bssid)
 		memcpy(ap_addr->sa_data, wdev->wext.ibss.bssid, ETH_ALEN);
 		memcpy(ap_addr->sa_data, wdev->wext.ibss.bssid, ETH_ALEN);
+	else
+		memset(ap_addr->sa_data, 0, ETH_ALEN);
+
 	wdev_unlock(wdev);
 	wdev_unlock(wdev);
 
 
 	return 0;
 	return 0;