cfg80211: fix race in giwrate
authorJohannes Berg <johannes@sipsolutions.net>
Tue, 7 Jul 2009 21:41:27 +0000 (23:41 +0200)
committerJohn W. Linville <linville@tuxdriver.com>
Fri, 24 Jul 2009 19:05:06 +0000 (15:05 -0400)
cfg80211_wext_giwrate doesn't lock the wdev, so it
cannot access current_bss race-free. Also, there's
little point in trying to ask the driver for an AP
that it never told us about, so avoid that case.

Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
net/wireless/wext-compat.c

index 9d101d566bb1c3d602a2c8dcea08dace11cc174e..5088d89a30fc3c14de81896de9b38d2746b06f53 100644 (file)
@@ -1127,7 +1127,7 @@ int cfg80211_wext_giwrate(struct net_device *dev,
        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
        /* we are under RTNL - globally locked - so can use a static struct */
        static struct station_info sinfo;
-       u8 *addr;
+       u8 addr[ETH_ALEN];
        int err;
 
        if (wdev->iftype != NL80211_IFTYPE_STATION)
@@ -1136,12 +1136,15 @@ int cfg80211_wext_giwrate(struct net_device *dev,
        if (!rdev->ops->get_station)
                return -EOPNOTSUPP;
 
+       err = 0;
+       wdev_lock(wdev);
        if (wdev->current_bss)
-               addr = wdev->current_bss->pub.bssid;
-       else if (wdev->wext.connect.bssid)
-               addr = wdev->wext.connect.bssid;
+               memcpy(addr, wdev->current_bss->pub.bssid, ETH_ALEN);
        else
-               return -EOPNOTSUPP;
+               err = -EOPNOTSUPP;
+       wdev_unlock(wdev);
+       if (err)
+               return err;
 
        err = rdev->ops->get_station(&rdev->wiphy, dev, addr, &sinfo);
        if (err)