nl80211: fix null-ptr dereference on invalid mesh configuration

If TX rates are specified during mesh join, the channel must also be specified. Check the channel pointer to avoid a null pointer dereference if it isn't. Reported-by: Jouni Malinen <[email protected]> Fixes: 8564e38 ("cfg80211: add checks for beacon rate, extend to mesh") Signed-off-by: Johannes Berg <[email protected]>
opendata26 · Sep 18, 2017 · 265698d · 265698d
1 parent e785fa0
commit 265698d
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
@@ -9987,6 +9987,9 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
 		if (err)
 			return err;
 
+		if (!setup.chandef.chan)
+			return -EINVAL;
+
 		err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
 					      &setup.beacon_rate);
 		if (err)