diff options
| author | Felix Fietkau <nbd@openwrt.org> | 2013-07-15 14:35:06 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2013-07-16 17:48:14 +0300 |
| commit | 5c9fc93bc9bc417418fc1b6366833ae6a07b804d (patch) | |
| tree | e1fb9841cd93ed7409cf2c2ccd89f416847632c6 | |
| parent | 6b0f32745dcfba01d7be33acd1b40306c7a914c6 (diff) | |
| download | op-kernel-dev-5c9fc93bc9bc417418fc1b6366833ae6a07b804d.zip op-kernel-dev-5c9fc93bc9bc417418fc1b6366833ae6a07b804d.tar.gz | |
mac80211/minstrel: fix NULL pointer dereference issue
When priv_sta == NULL, mi->prev_sample is dereferenced too early. Move
the assignment further down, after the rate_control_send_low call.
Reported-by: Krzysztof Mazur <krzysiek@podlesie.net>
Cc: stable@vger.kernel.org # 3.10
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/mac80211/rc80211_minstrel.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c index ac7ef54..e6512e2 100644 --- a/net/mac80211/rc80211_minstrel.c +++ b/net/mac80211/rc80211_minstrel.c @@ -290,7 +290,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, struct minstrel_rate *msr, *mr; unsigned int ndx; bool mrr_capable; - bool prev_sample = mi->prev_sample; + bool prev_sample; int delta; int sampling_ratio; @@ -314,6 +314,7 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta, (mi->sample_count + mi->sample_deferred / 2); /* delta < 0: no sampling required */ + prev_sample = mi->prev_sample; mi->prev_sample = false; if (delta < 0 || (!mrr_capable && prev_sample)) return; |
