summaryrefslogtreecommitdiffstats
path: root/net/wireless
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2011-11-21 10:44:00 +0100
committerJohn W. Linville <linville@tuxdriver.com>2011-11-21 14:45:20 -0500
commitde3584bd62d87b4c250129fbc46ca52c80330add (patch)
tree834162bf0c3af2bfec813fdb696157f637b307fb /net/wireless
parent9c8f2c42c93f415771d6d7b87a0881ba0bb72824 (diff)
downloadlinux-de3584bd62d87b4c250129fbc46ca52c80330add.tar.bz2
cfg80211: fix regulatory NULL dereference
By the time userspace returns with a response to the regulatory domain request, the wiphy causing the request might have gone away. If this is so, reject the update but mark the request as having been processed anyway. Cc: Luis R. Rodriguez <lrodriguez@qca.qualcomm.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Cc: stable@vger.kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'net/wireless')
-rw-r--r--net/wireless/reg.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index bc1ec2c26fd0..186b7f2a27b6 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2035,6 +2035,10 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
}
request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx);
+ if (!request_wiphy) {
+ reg_set_request_processed();
+ return -ENODEV;
+ }
if (!last_request->intersect) {
int r;