• C
    p54: fix off-by-one null pointer bug in p54_tx_80211 · 390fd9d6
    Christian Lamparter 提交于
    This patch fixes a regression which was introduced in:
    "mac80211: move TX station pointer and restructure TX"
    
    IP: p54_tx_80211+0x21/0x513 [p54common]
    Oops: 0000 [#1] SMP
    Modules linked in: p54usb p54common [...]
    Pid: 13394, comm: hostapd 3.6.0-rc4-wl+
    RIP: 0010:p54_tx_80211+0x21/0x513
    RSP: 0018:...  EFLAGS: 00010292
    [...]
    Process hostapd
    Stack:
    [...]
    Call Trace:
    p54_bss_info_changed+0x204/0x21e [p54common]
    ieee80211_del_station+0x16/0x32 [mac80211]
    ieee80211_start_ap+0x10f/0x157 [mac80211]
    nl80211_start_ap+0x315/0x361 [cfg80211]
    
    p54_tx_80211 function is called as part of the
    beacon update. The caller p54_bss_info_changed
    has to supply a valid tx control struct, or
    the control->sta will lead to a null pointer
    dereference.
    Signed-off-by: NChristian Lamparter <chunkeey@googlemail.com>
    Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
    390fd9d6
main.c 20.7 KB