cfg80211: fix scan crash on single-band cards (a401d2bb) · Commits · 戴 / test

commit 58389c69150e6032504dfcd3edca6b1975c8b5bc Author: Johannes Berg <johannes.berg@intel.com> Date: Mon Jul 18 18:08:35 2011 +0200 cfg80211: allow userspace to control supported rates in scan made single-band cards crash since it would always access all wiphy->bands[]. Fix this and reject any attempts in the new helper ieee80211_get_ratemask() to do the same, rejecting rates configuration for unsupported bands. Reported-by:

Pavel Roskin <proski@gnu.org> Tested-by:

Pavel Roskin <proski@gnu.org> Signed-off-by:

Johannes Berg <johannes.berg@intel.com> Signed-off-by:

John W. Linville <linville@tuxdriver.com>

net/wireless/nl80211.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -3454,7 +3454,9 @@ static int nl80211_trigger_scan(struct sk_buff skb, struct genl_info info)
		}

		for (i = 0; i < IEEE80211_NUM_BANDS; i++)
		request->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;
		if (wiphy->bands[i])
		request->rates[i] =
		(1 << wiphy->bands[i]->n_bitrates) - 1;

		if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
		nla_for_each_nested(attr,

net/wireless/scan.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -863,6 +863,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
		}

		for (i = 0; i < IEEE80211_NUM_BANDS; i++)
		if (wiphy->bands[i])
		creq->rates[i] = (1 << wiphy->bands[i]->n_bitrates) - 1;

		rdev->scan_req = creq;

net/wireless/util.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -1013,6 +1013,9 @@ int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
		{
		int i, j;

		if (!sband)
		return -EINVAL;

		if (n_rates == 0 \|\| n_rates > NL80211_MAX_SUPP_RATES)
		return -EINVAL;

Admin message