From 040bdf713d2bec8235f1af705e2d13da5d9baec8 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Wed, 10 Aug 2011 19:00:33 -0600 Subject: cfg80211: fix a crash in nl80211_send_station mac80211 leaves sinfo->assoc_req_ies uninitialized, causing a random pointer memory access in nl80211_send_station. Instead of checking if the pointer is null, use sinfo->filled, like the rest of the fields. Signed-off-by: Felix Fietkau Signed-off-by: John W. Linville --- net/wireless/nl80211.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net/wireless/nl80211.c') diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index ca7697701076..253e56319d7e 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -2236,7 +2236,7 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq, } nla_nest_end(msg, sinfoattr); - if (sinfo->assoc_req_ies) + if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES) NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, sinfo->assoc_req_ies); -- cgit v1.2.3