summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2010-10-29 21:25:39 +0000
committerJo-Philipp Wich <jow@openwrt.org>2010-10-29 21:25:39 +0000
commit434c8dbf3353a40e931d0db2e35fa2c8b4cbe576 (patch)
treec48605f995a2f54194ecc6f226d9d2d49cf098b6
parent9d61a9b1c6e57e6b07cf19dc0cbe78bc1b0e5f70 (diff)
downloadmtk-20170518-434c8dbf3353a40e931d0db2e35fa2c8b4cbe576.zip
mtk-20170518-434c8dbf3353a40e931d0db2e35fa2c8b4cbe576.tar.gz
mtk-20170518-434c8dbf3353a40e931d0db2e35fa2c8b4cbe576.tar.bz2
package/hostapd: fix crash in atheros driver (#8143) hapd->driver->set_operstate may happen when the drv_priv data is not initialized yet, this leads to a null pointer deref in the atheros driver. Protect the operstate call with a check for hapd->drv_priv.
SVN-Revision: 23715
-rw-r--r--package/hostapd/patches/460-oper_state_fix.patch22
1 files changed, 22 insertions, 0 deletions
diff --git a/package/hostapd/patches/460-oper_state_fix.patch b/package/hostapd/patches/460-oper_state_fix.patch
index 5a685a2..8ea0e12 100644
--- a/package/hostapd/patches/460-oper_state_fix.patch
+++ b/package/hostapd/patches/460-oper_state_fix.patch
@@ -23,3 +23,25 @@ DORMANT state does not prevent normal operations after that.
return 0;
}
+--- a/src/drivers/driver_wext.c
++++ b/src/drivers/driver_wext.c
+@@ -2245,11 +2245,14 @@ int wpa_driver_wext_set_operstate(void *
+ {
+ struct wpa_driver_wext_data *drv = priv;
+
+- wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
+- __func__, drv->operstate, state, state ? "UP" : "DORMANT");
+- drv->operstate = state;
+- return netlink_send_oper_ifla(drv->netlink, drv->ifindex, -1,
+- state ? IF_OPER_UP : IF_OPER_DORMANT);
++ if (drv != NULL)
++ {
++ wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
++ __func__, drv->operstate, state, state ? "UP" : "DORMANT");
++ drv->operstate = state;
++ return netlink_send_oper_ifla(drv->netlink, drv->ifindex, -1,
++ state ? IF_OPER_UP : IF_OPER_DORMANT);
++ }
+ }
+
+