2013-06-19 11:37:38

by Antonio Quartulli

[permalink] [raw]
Subject: [PATCH mac80211-next] brcm80211: fix null pointer access

From: Antonio Quartulli <[email protected]>

Do not unconditionally access the chan variable in
brcmf_cfg80211_mgmt_tx() as it may be NULL.
Use freq instead.

Introduced by c2ff8cad64233b539c71a27e2a6e324001143ef0
("brcm80211: make mgmt_tx in brcmfmac accept a NULL channel")

Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>
---
drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 8bd256b..d316d62 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -3985,8 +3985,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
le16_to_cpu(action_frame->len));

brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
- *cookie, le16_to_cpu(action_frame->len),
- chan->center_freq);
+ *cookie, le16_to_cpu(action_frame->len), freq);

ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
af_params);
--
1.8.1.5



2013-06-19 19:30:12

by John W. Linville

[permalink] [raw]
Subject: Re: [PATCH mac80211-next] brcm80211: fix null pointer access

FWIW, driver fixes like this come to me rather than Johannes...

On Wed, Jun 19, 2013 at 01:35:31PM +0200, Antonio Quartulli wrote:
> From: Antonio Quartulli <[email protected]>
>
> Do not unconditionally access the chan variable in
> brcmf_cfg80211_mgmt_tx() as it may be NULL.
> Use freq instead.
>
> Introduced by c2ff8cad64233b539c71a27e2a6e324001143ef0
> ("brcm80211: make mgmt_tx in brcmfmac accept a NULL channel")
>
> Reported-by: Dan Carpenter <[email protected]>
> Signed-off-by: Antonio Quartulli <[email protected]>
> ---
> drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
> index 8bd256b..d316d62 100644
> --- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
> +++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
> @@ -3985,8 +3985,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
> le16_to_cpu(action_frame->len));
>
> brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
> - *cookie, le16_to_cpu(action_frame->len),
> - chan->center_freq);
> + *cookie, le16_to_cpu(action_frame->len), freq);
>
> ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
> af_params);
> --
> 1.8.1.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>

--
John W. Linville Someday the world will need a hero, and you
[email protected] might be all we have. Be ready.

2013-06-19 19:50:31

by Antonio Quartulli

[permalink] [raw]
Subject: Re: [PATCH mac80211-next] brcm80211: fix null pointer access

Hi John,

On Wed, Jun 19, 2013 at 12:27:14PM -0700, John W. Linville wrote:
> FWIW, driver fixes like this come to me rather than Johannes...
>

I sent this to Johannes because this is fixing a patch I sent a couple of days
ago, and therefore I did not know if this patch was already in your tree or not.

Cheers,

--
Antonio Quartulli

..each of us alone is worth nothing..
Ernesto "Che" Guevara


Attachments:
(No filename) (399.00 B)
signature.asc (836.00 B)
Digital signature
Download all attachments