Browse Source

package/hostapd: fix crash in atheros driver (#8143) hapd->driver->set_operstate may happen when the drv_priv data is not initialized yet, this leads to a null pointer deref in the atheros driver. Protect the operstate call with a check for hapd->drv_priv.

SVN-Revision: 23715
Jo-Philipp Wich 15 years ago
parent
commit
434c8dbf33
1 changed files with 22 additions and 0 deletions
  1. 22 0
      package/hostapd/patches/460-oper_state_fix.patch

+ 22 - 0
package/hostapd/patches/460-oper_state_fix.patch

@@ -23,3 +23,25 @@ DORMANT state does not prevent normal operations after that.
  	return 0;
  	return 0;
  }
  }
  
  
+--- a/src/drivers/driver_wext.c
++++ b/src/drivers/driver_wext.c
+@@ -2245,11 +2245,14 @@ int wpa_driver_wext_set_operstate(void *
+ {
+ 	struct wpa_driver_wext_data *drv = priv;
+ 
+-	wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
+-		   __func__, drv->operstate, state, state ? "UP" : "DORMANT");
+-	drv->operstate = state;
+-	return netlink_send_oper_ifla(drv->netlink, drv->ifindex, -1,
+-				      state ? IF_OPER_UP : IF_OPER_DORMANT);
++	if (drv != NULL)
++	{
++		wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
++			   __func__, drv->operstate, state, state ? "UP" : "DORMANT");
++		drv->operstate = state;
++		return netlink_send_oper_ifla(drv->netlink, drv->ifindex, -1,
++					      state ? IF_OPER_UP : IF_OPER_DORMANT);
++	}
+ }
+ 
+