2011-03-26 17:59:10

by Mariusz Kozlowski

Subject: [PATCH] mac80211: fix possible NULL pointer dereference

This patch moves 'key' dereference after BUG_ON(!key) so that when key is NULL
we will see proper trace instead of oops.

Signed-off-by: Mariusz Kozlowski <[email protected]>
---
net/mac80211/key.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 8c02469..fd97925 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -400,11 +400,12 @@ int ieee80211_key_link(struct ieee80211_key *key,
{
struct ieee80211_key *old_key;
int idx, ret;
- bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
+ bool pairwise;

BUG_ON(!sdata);
BUG_ON(!key);

+ pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
idx = key->conf.keyidx;
key->local = sdata->local;
key->sdata = sdata;
--
1.7.0.4

2011-03-27 09:17:44

by Johannes Berg

Subject: Re: [PATCH] mac80211: fix possible NULL pointer dereference

On Sat, 2011-03-26 at 18:58 +0100, Mariusz Kozlowski wrote:
> This patch moves 'key' dereference after BUG_ON(!key) so that when key is NULL
> we will see proper trace instead of oops.
>
> Signed-off-by: Mariusz Kozlowski <[email protected]>

Acked-by: Johannes Berg <[email protected]>

I guess, not that it matters much since it's extremely unlikely somebody
will attemt to misuse this function :-)

johannes