From patchwork Tue Aug 28 20:13:20 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Amit Pundir X-Patchwork-Id: 145365 Delivered-To: patch@linaro.org Received: by 2002:a2e:1648:0:0:0:0:0 with SMTP id 8-v6csp1589330ljw; Tue, 28 Aug 2018 13:13:59 -0700 (PDT) X-Google-Smtp-Source: ANB0VdY6uJAERO/GXgeK6Wr6DKzXDqkrTu9V/C6tY7dx25HWVOhPcskiYpKS7kBjuvZPG0qMqwdL X-Received: by 2002:a63:24c:: with SMTP id 73-v6mr2999809pgc.252.1535487238932; Tue, 28 Aug 2018 13:13:58 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1535487238; cv=none; d=google.com; s=arc-20160816; b=gRPdfwueoEkdwBlYXpH5tORJwZ8qOtUp1nXtYbL5ahcEJiSagGo3AtOpFtM9K0QESO r+dh8Hgl+jof7Yh9VZNGvQxOIHEYCCbsirew7r8D0t+EaozJMshM99qVlJITvd/vI4LS Bhfjxsk6Gzt68gfwG/0uNe3aQ9ziSKW8sl9mAPwt8D6eCcFtGf8ctNjbRASeyhlc18T+ ptC6veA5hgqevwWanfE9my7fcowqIA9kAjOr0cirbzui6o0Tno9OeRSjEbPJXe7emJNo oqYSJy/87/Xp7OV+n0UpjxdD8oNBJ+Yj4y4jVqAE9ld1MLVszc6XjYknoPgftZjdET6H jEnQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=5Wx3Vk+m13O+tLb6eC1+vGJ7O1A2F6aM7GY1IjybIn8=; b=A1AOEEkQL42sSn3Nfyw7RA6krT8jmXGxJlqUUczybl2k5vB6B2hB6+2Tw5mb/VYCGK sguYdctAy7CHBkWqDAlXloMQZm6ocBfk24oJDH9Wq69R6xDQPDHUoYR6NWIcIsAsCOnn S/8MMwTPmCEBFNb1kfYaIlQRhzCjukPxsTrAqJDJMmkQsVdbJ9G5L8gP3/8i7ZqxP5vg VtoMC4XSpjnj9nr3KZ5NK66zKVFXhAAgruXLTCNGwCuTMrqiTeD4X3SkWd5MsFiamXAF dn7q6kkpRuBNKBAiWWHAsla4VQEpbD/wAkUec6Z0yj5oxGAAaVDSyhh+cChVrWAIZiCn j/oA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=glSFnYJG; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id y10-v6si1906969pgf.312.2018.08.28.13.13.58; Tue, 28 Aug 2018 13:13:58 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=glSFnYJG; spf=pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727178AbeH2AHM (ORCPT + 13 others); Tue, 28 Aug 2018 20:07:12 -0400 Received: from mail-pl1-f195.google.com ([209.85.214.195]:36542 "EHLO mail-pl1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726961AbeH2AHM (ORCPT ); Tue, 28 Aug 2018 20:07:12 -0400 Received: by mail-pl1-f195.google.com with SMTP id e11-v6so1210867plb.3 for ; Tue, 28 Aug 2018 13:13:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=5Wx3Vk+m13O+tLb6eC1+vGJ7O1A2F6aM7GY1IjybIn8=; b=glSFnYJGI+bAS4+2Gzjq0noD2/dYK8BXJ9a/v3rQOoydnur+GO9qvmLE9Ff/o5SmlW 2p+UlgxO+J9/h4jVzvHtQi/Y4h6ag+b0YMmLdGM8/fbL9/KUpRsxnuhIKh6WAxHrmD0P YvEdzeFH1OjI2KCkogcWNJYMAZc1jZWg7YwCo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=5Wx3Vk+m13O+tLb6eC1+vGJ7O1A2F6aM7GY1IjybIn8=; b=Sgf+Riu0knXvR98lcgo4PnQv5aLhndNEDKOlByZGvQit0omfk9XNIeNz0KFVQQKnRE pQLFy1q3pQZnZsUg/CNT5fiTtIgTe9imPuOfO5qchem7nJJchnamvKQ5vckaaYMCs9Q3 SHTyS9BXi+IMdbAbSH8f4wDbBiPaFZcZs1LzRS1E7frTmxDDyJSUAq0SZPf9exevNXOQ neKH5B+crYFldE4C9KKZrXDwY+wZgDXtrlx+MVyIUQiUcaxo6KovpGbLvVzvnvijGNn7 6HxiQQnqlwTKAWTJNtriLkRXfRCQetyEHoyfMuewIptb6sXp+1vbNQMPej/gx6ozizR0 SBwg== X-Gm-Message-State: APzg51DDKJpQBf5487rle3uWcV2iQ+jo32Vyzo4ArqPbsrovINpncgOt zLhky4QoANSMWHagPEdrxJjvig== X-Received: by 2002:a17:902:82c5:: with SMTP id u5-v6mr2895664plz.83.1535487237583; Tue, 28 Aug 2018 13:13:57 -0700 (PDT) Received: from localhost.localdomain ([49.207.48.21]) by smtp.gmail.com with ESMTPSA id t86-v6sm3098181pfe.109.2018.08.28.13.13.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 28 Aug 2018 13:13:56 -0700 (PDT) From: Amit Pundir To: Greg KH Cc: Stable , Johannes Berg Subject: [PATCH for-4.9.y 09/14] nl80211: fix null-ptr dereference on invalid mesh configuration Date: Wed, 29 Aug 2018 01:43:20 +0530 Message-Id: <1535487205-26280-10-git-send-email-amit.pundir@linaro.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1535487205-26280-1-git-send-email-amit.pundir@linaro.org> References: <1535487205-26280-1-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johannes Berg commit 265698d7e6132a2d41471135534f4f36ad15b09c upstream. If TX rates are specified during mesh join, the channel must also be specified. Check the channel pointer to avoid a null pointer dereference if it isn't. Reported-by: Jouni Malinen Fixes: 8564e38206de ("cfg80211: add checks for beacon rate, extend to mesh") Signed-off-by: Johannes Berg Signed-off-by: Amit Pundir --- net/wireless/nl80211.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.7.4 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 5b75468b5acd..d8002be808f2 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -9480,6 +9480,9 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) if (err) return err; + if (!setup.chandef.chan) + return -EINVAL; + err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, &setup.beacon_rate); if (err)