summaryrefslogtreecommitdiff
path: root/drivers/net
diff options
context:
space:
mode:
authorChristian Lamparter <chunkeey@googlemail.com>2012-09-08 03:28:42 +0400
committerJohn W. Linville <linville@tuxdriver.com>2012-09-11 23:13:54 +0400
commit390fd9d6c223980190adf44af5c7ba0662ff61e3 (patch)
tree0e716e352e2138e628a992fcae89167b6c2ee25a /drivers/net
parent28ab58bd6a80408af79999492c8a28c8910ef62e (diff)
downloadlinux-390fd9d6c223980190adf44af5c7ba0662ff61e3.tar.xz
p54: fix off-by-one null pointer bug in p54_tx_80211
This patch fixes a regression which was introduced in: "mac80211: move TX station pointer and restructure TX" IP: p54_tx_80211+0x21/0x513 [p54common] Oops: 0000 [#1] SMP Modules linked in: p54usb p54common [...] Pid: 13394, comm: hostapd 3.6.0-rc4-wl+ RIP: 0010:p54_tx_80211+0x21/0x513 RSP: 0018:... EFLAGS: 00010292 [...] Process hostapd Stack: [...] Call Trace: p54_bss_info_changed+0x204/0x21e [p54common] ieee80211_del_station+0x16/0x32 [mac80211] ieee80211_start_ap+0x10f/0x157 [mac80211] nl80211_start_ap+0x315/0x361 [cfg80211] p54_tx_80211 function is called as part of the beacon update. The caller p54_bss_info_changed has to supply a valid tx control struct, or the control->sta will lead to a null pointer dereference. Signed-off-by: Christian Lamparter <chunkeey@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net')
-rw-r--r--drivers/net/wireless/p54/main.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 5e91ad06dd5d..2969d5321ca6 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -139,6 +139,7 @@ static int p54_beacon_format_ie_tim(struct sk_buff *skb)
static int p54_beacon_update(struct p54_common *priv,
struct ieee80211_vif *vif)
{
+ struct ieee80211_tx_control control = { };
struct sk_buff *beacon;
int ret;
@@ -158,7 +159,7 @@ static int p54_beacon_update(struct p54_common *priv,
* to cancel the old beacon template by hand, instead the firmware
* will release the previous one through the feedback mechanism.
*/
- p54_tx_80211(priv->hw, NULL, beacon);
+ p54_tx_80211(priv->hw, &control, beacon);
priv->tsf_high32 = 0;
priv->tsf_low32 = 0;