diff options
| author | Johannes Berg <johannes.berg@intel.com> | 2011-11-21 10:44:00 +0100 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2011-11-21 14:45:20 -0500 |
| commit | de3584bd62d87b4c250129fbc46ca52c80330add (patch) | |
| tree | 834162bf0c3af2bfec813fdb696157f637b307fb | |
| parent | 9c8f2c42c93f415771d6d7b87a0881ba0bb72824 (diff) | |
| download | op-kernel-dev-de3584bd62d87b4c250129fbc46ca52c80330add.zip op-kernel-dev-de3584bd62d87b4c250129fbc46ca52c80330add.tar.gz | |
cfg80211: fix regulatory NULL dereference
By the time userspace returns with a response to
the regulatory domain request, the wiphy causing
the request might have gone away. If this is so,
reject the update but mark the request as having
been processed anyway.
Cc: Luis R. Rodriguez <lrodriguez@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | net/wireless/reg.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/net/wireless/reg.c b/net/wireless/reg.c index bc1ec2c..186b7f2 100644 --- a/net/wireless/reg.c +++ b/net/wireless/reg.c @@ -2035,6 +2035,10 @@ static int __set_regdom(const struct ieee80211_regdomain *rd) } request_wiphy = wiphy_idx_to_wiphy(last_request->wiphy_idx); + if (!request_wiphy) { + reg_set_request_processed(); + return -ENODEV; + } if (!last_request->intersect) { int r; |
