Files
linux/drivers
Johannes Berg aed0fd4acd iwlagn: fix NULL ptr deref when reprogramming sta w/o LQ
Reinette reports a crash in iwl_reprogram_ap_sta(). The
debugging shows:

  b1 16    mov    $0x16,%cl
 *f3 a5    rep movsl %ds     <-- trapping instruction:(%rsi),%es:(%rdi)

which is a memcpy of 22 (0x16) words (movsl). this points
to "priv->stations[sta_id].lq" being NULL since that is
the memcpy() of that size here.

The only way I see for this to happen is if we try to
do some RXON reprogramming while connecting to an AP,
after tx_sync() but before full setup, but that seems
like something that might very well happen.

Fix this by checking if the LQ is present and only then
reprogramming it.

Reported-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2011-11-11 12:32:52 -05:00
..
2011-10-02 00:19:34 +02:00
2011-10-13 13:49:37 -06:00
2011-09-15 15:08:18 +02:00
2011-09-27 18:08:04 +02:00
2011-09-27 18:08:04 +02:00
2011-09-21 16:19:44 -04:00
2011-09-27 18:08:04 +02:00
2011-10-04 10:10:50 -06:00
2011-10-24 21:00:34 +02:00