mac80211_hwsim: Fix NULL pointer dereference
authorJavier Lopez <jlopex@cozybit.com>
Mon, 16 Dec 2013 18:01:07 +0000 (10:01 -0800)
committerJohannes Berg <johannes.berg@intel.com>
Mon, 16 Dec 2013 20:17:07 +0000 (21:17 +0100)
mac80211_hwsim was crashing when receiving tx information from user
space. Crash happens because txi->rate_driver_data[0] is pointing to a
non valid memory address.

This code path is only used by wmediumd and wmediumd doesn't provide
multiple channel support, so we can pass the channel struct
(data2->channel) directly to mac80211_hwsim_monitor_ack function.

Signed-off-by: Javier Lopez <jlopex@cozybit.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/mac80211_hwsim.c

index c72438bb2fafd24b8e59f416d4e4311752dce941..a1b32ee9594a6b9b899caa03cea53f3d9a0ddf90 100644 (file)
@@ -2011,7 +2011,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
           (hwsim_flags & HWSIM_TX_STAT_ACK)) {
                if (skb->len >= 16) {
                        hdr = (struct ieee80211_hdr *) skb->data;
-                       mac80211_hwsim_monitor_ack(txi->rate_driver_data[0],
+                       mac80211_hwsim_monitor_ack(data2->channel,
                                                   hdr->addr2);
                }
                txi->flags |= IEEE80211_TX_STAT_ACK;