提交 621ad7c9 编写于 作者: J John W. Linville

mac80211: avoid NULL ptr deref when finding max_rates in PID and minstrel

"There is another problem with this piece of code. The sband will be NULL
after second iteration on single band device and cause null pointer
dereference. Everything is working with dual band card. Sorry, but i
don't know how to explain this clearly in English. I have looked on the
second patch for pid algorithm and found similar bug."
Reported-by: NKarol Szuster <qflon@o2.pl>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
上级 aedec922
...@@ -477,7 +477,7 @@ minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp) ...@@ -477,7 +477,7 @@ minstrel_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
for (i = 0; i < IEEE80211_NUM_BANDS; i++) { for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
sband = hw->wiphy->bands[i]; sband = hw->wiphy->bands[i];
if (sband->n_bitrates > max_rates) if (sband && sband->n_bitrates > max_rates)
max_rates = sband->n_bitrates; max_rates = sband->n_bitrates;
} }
......
...@@ -378,7 +378,7 @@ static void *rate_control_pid_alloc(struct ieee80211_hw *hw, ...@@ -378,7 +378,7 @@ static void *rate_control_pid_alloc(struct ieee80211_hw *hw,
for (i = 0; i < IEEE80211_NUM_BANDS; i++) { for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
sband = hw->wiphy->bands[i]; sband = hw->wiphy->bands[i];
if (sband->n_bitrates > max_rates) if (sband && sband->n_bitrates > max_rates)
max_rates = sband->n_bitrates; max_rates = sband->n_bitrates;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册