iwlwifi: fix possible NULL dereference in iwl_set_rate()

From 25db44d4cdfe31d59223d74cb577f4a71aff1a40 Mon Sep 17 00:00:00 2001

As per Zhu Yi's request, Im forwarding along a patch for CVE-2007-5938, a NULL dereference vulnerability in the iwlwifi driver. All current versions are effected by this.

Thanks.

Signature · 2 lines

Saleem Abdulrasool
compnerd (at) compnerd (dot) org

Quoted 1 line

From 25db44d4cdfe31d59223d74cb577f4a71aff1a40 Mon Sep 17 00:00:00 2001

From: Saleem Abdulrasool <[email protected]>
Date: Mon, 19 Nov 2007 15:28:58 +0800
Subject: [PATCH] iwlwifi: fix possible NULL dereference in iwl_set_rate()

Signed-off-by Saleem Abdulrasool <[email protected]>

Signed-off-by Zhu Yi <[email protected]>

---
 origin/iwl3945-base.c |    4 ++++
 origin/iwl4965-base.c |    4 ++++
 2 files changed, 8 insertions(+), 0 deletions(-)

origin/iwl3945-base.c +4 -0

index 5d3e5fe..0885b56 100644
@@ -2984,6 +2984,10 @@ static void iwl3945_set_rate(struct iwl3945_priv *priv)
 	int i;
 
 	hw = iwl3945_get_hw_mode(priv, priv->phymode);
+	if (!hw) {
+		IWL_ERROR("Failed to set rate: unable to get hw mode\n");
+		return;
+	}
 
 	priv->active_rate = 0;
 	priv->active_rate_basic = 0;

origin/iwl4965-base.c +4 -0

index abb8016..c57ec27 100644
@@ -3093,6 +3093,10 @@ static void iwl4965_set_rate(struct iwl4965_priv *priv)
 	int i;
 
 	hw = iwl4965_get_hw_mode(priv, priv->phymode);
+	if (!hw) {
+		IWL_ERROR("Failed to set rate: unable to get hw mode\n");
+		return;
+	}
 
 	priv->active_rate = 0;
 	priv->active_rate_basic = 0;

Quoted 3 lines · Saleem Abdulrasool

As per Zhu Yi's request, Im forwarding along a patch for CVE-2007-5938, a NULL dereference vulnerability in the iwlwifi driver. All current versions are effected by this.

ACK.