mac80211: fix invalid band deref building preq IEs

The function building probe-request IEs does not validate the band is
supported before dereferencing it. This can result in a panic when
all bands are traversed, as done during sched-scan start.

Warn when this happens and return an empty probe request. Also fix
sched-scan to not waste memory on unsupported bands.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 379f178eab5f162a7c77f7f1ff66315b901f0f0b..1ff04f689d1fdd47c9df09b6956b4bb9f644fdb0 100644 (file)
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -928,6 +928,9 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
        }
 
        for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+               if (!local->hw.wiphy->bands[i])
+                       continue;
+
                local->sched_scan_ies.ie[i] = kzalloc(2 +
                                                      IEEE80211_MAX_SSID_LEN +
                                                      local->scan_ies_len +

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 64493a7bef1a388a1f7f2a9aca8d13b7834d52fb..596db0c2a113e22dd1162dc591d8d62bef5131bb 100644 (file)
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -999,6 +999,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
        int ext_rates_len;
 
        sband = local->hw.wiphy->bands[band];
+       if (WARN_ON_ONCE(!sband))
+               return 0;
 
        pos = buffer;