Commit 5c9fc93b authored by Felix Fietkau's avatar Felix Fietkau Committed by Johannes Berg

mac80211/minstrel: fix NULL pointer dereference issue

When priv_sta == NULL, mi->prev_sample is dereferenced too early. Move
the assignment further down, after the rate_control_send_low call.
Reported-by: default avatarKrzysztof Mazur <krzysiek@podlesie.net>
Cc: stable@vger.kernel.org # 3.10
Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 6b0f3274
...@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, ...@@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
struct minstrel_rate *msr, *mr; struct minstrel_rate *msr, *mr;
unsigned int ndx; unsigned int ndx;
bool mrr_capable; bool mrr_capable;
bool prev_sample = mi->prev_sample; bool prev_sample;
int delta; int delta;
int sampling_ratio; int sampling_ratio;
...@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, ...@@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
(mi->sample_count + mi->sample_deferred / 2); (mi->sample_count + mi->sample_deferred / 2);
/* delta < 0: no sampling required */ /* delta < 0: no sampling required */
prev_sample = mi->prev_sample;
mi->prev_sample = false; mi->prev_sample = false;
if (delta < 0 || (!mrr_capable && prev_sample)) if (delta < 0 || (!mrr_capable && prev_sample))
return; return;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment