• Johannes Berg's avatar
    wext: fix NULL-ptr-dereference with cfg80211's lack of commit() · 51225651
    Johannes Berg authored
    Since cfg80211 doesn't implement commit, we never really cared about
    that code there (and it's configured out w/o CONFIG_WIRELESS_EXT).
    After all, since it has no commit, it shouldn't return -EIWCOMMIT to
    indicate commit is needed.
    
    However, EIWCOMMIT is actually an alias for EINPROGRESS, which _can_
    happen if e.g. we try to change the frequency but we're already in
    the process of connecting to some network, and drivers could return
    that value (or even cfg80211 itself might).
    
    This then causes us to crash because dev->wireless_handlers is NULL
    but we try to check dev->wireless_handlers->standard[0].
    
    Fix this by also checking dev->wireless_handlers. Also simplify the
    code a little bit.
    
    Cc: stable@vger.kernel.org
    Reported-by: syzbot+444248c79e117bc99f46@syzkaller.appspotmail.com
    Reported-by: syzbot+8b2a88a09653d4084179@syzkaller.appspotmail.com
    Link: https://lore.kernel.org/r/20210121171621.2076e4a37d5a.I5d9c72220fe7bb133fb718751da0180a57ecba4e@changeidSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    51225651
wext-core.c 31.6 KB