diff mbox

mac80211: fix oops in ieee80211_beacon_get_tim

Message ID 1673287.PfdWxMzLgk@debian64 (mailing list archive)
State Accepted
Delegated to: Johannes Berg
Headers show

Commit Message

Christian Lamparter Sept. 28, 2015, 6:58 p.m. UTC
This patch fixes a crash which is triggered
by __ieee80211_beacon_get returning NULL.
This causes sky_copy to crash later unless
the hardware supports BEACON_TX_STATUS
feature.

Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
---
"mac80211: Copy tx'ed beacons to monitor mode" added the skb_copy.
There are few other possibilities to do this. This is just one.
---
 net/mac80211/tx.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Helmut Schaa Sept. 28, 2015, 7:04 p.m. UTC | #1
Christian Lamparter <chunkeey@googlemail.com> schrieb:
>This patch fixes a crash which is triggered
>by __ieee80211_beacon_get returning NULL.

Ouch, thanks for catching this!
Helmut

>This causes sky_copy to crash later unless
>the hardware supports BEACON_TX_STATUS
>feature.
>
>Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
>---
>"mac80211: Copy tx'ed beacons to monitor mode" added the skb_copy.
>There are few other possibilities to do this. This is just one.
>---
> net/mac80211/tx.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
>index f7317a7..666e46b 100644
>--- a/net/mac80211/tx.c
>+++ b/net/mac80211/tx.c
>@@ -3530,6 +3530,9 @@ struct sk_buff *ieee80211_beacon_get_tim(struct
>ieee80211_hw *hw,
> 	struct ieee80211_supported_band *sband;
> 	int shift;
> 
>+	if (!bcn)
>+		return bcn;
>+
> 	if (tim_offset)
> 		*tim_offset = offs.tim_offset;
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Johannes Berg Sept. 29, 2015, 1:58 p.m. UTC | #2
On Mon, 2015-09-28 at 20:58 +0200, Christian Lamparter wrote:
> This patch fixes a crash which is triggered
> by __ieee80211_beacon_get returning NULL.
> This causes sky_copy to crash later unless
> the hardware supports BEACON_TX_STATUS
> feature.
> 
> Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
> ---
> "mac80211: Copy tx'ed beacons to monitor mode" added the skb_copy.
> There are few other possibilities to do this. This is just one.

Thanks, I rebased this in ...

johannes
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index f7317a7..666e46b 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -3530,6 +3530,9 @@  struct sk_buff *ieee80211_beacon_get_tim(struct ieee80211_hw *hw,
 	struct ieee80211_supported_band *sband;
 	int shift;
 
+	if (!bcn)
+		return bcn;
+
 	if (tim_offset)
 		*tim_offset = offs.tim_offset;