Skip to contentSkip to conversation

mac80211: minstrel, fix memory corruption

PATCH New Karol Szuster 2 participants 2 messages May 5, 2009 mac80211

lore
Share & tools
lore
#0 lore raw

Hi,

There is another problem with this piece of code. The sband will be NULL after second iteration on single band device and cause null pointer dereference. Everything is working with dual band card. Sorry, but i don't know how to explain this clearly in English. I have looked on the second patch for pid algorithm and found similar bug.

#1 lore raw

PATCH 1/1 mac80211: avoid NULL ptr deref when finding max_rates in PID and minstrel

"There is another problem with this piece of code. The sband will be NULL after second iteration on single band device and cause null pointer dereference. Everything is working with dual band card. Sorry, but i don't know how to explain this clearly in English. I have looked on the second patch for pid algorithm and found similar bug."

---
 net/mac80211/rc80211_minstrel.c |    2 +-
 net/mac80211/rc80211_pid_algo.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
net/mac80211/rc80211_minstrel.c +1 -1
index 70df3dc..d9233ec 100644
@@ -477,7 +477,7 @@ minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
 
 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
 		sband = hw->wiphy->bands[i];
-		if (sband->n_bitrates > max_rates)
+		if (sband && sband->n_bitrates > max_rates)
 			max_rates = sband->n_bitrates;
 	}
 
net/mac80211/rc80211_pid_algo.c +1 -1
index 01d59a8..8bef9a1 100644
@@ -378,7 +378,7 @@ static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
 
 	for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
 		sband = hw->wiphy->bands[i];
-		if (sband->n_bitrates > max_rates)
+		if (sband && sband->n_bitrates > max_rates)
 			max_rates = sband->n_bitrates;
 	}
 
Signature · 1 line
1.6.0.6