diff options
author | Felix Fietkau <nbd@openwrt.org> | 2010-01-24 23:39:00 +0000 |
---|---|---|
committer | Felix Fietkau <nbd@openwrt.org> | 2010-01-24 23:39:00 +0000 |
commit | 660874f45ecf5fd3dc19dd11e2e2006958db3467 (patch) | |
tree | 8178c6961d24310356875e5880d58d72f157e2b5 /package/madwifi/patches/451-ibss_race_fix.patch | |
parent | ab82f72a297955dc01051bc61ffff4e06fd1e1f0 (diff) | |
download | upstream-660874f45ecf5fd3dc19dd11e2e2006958db3467.tar.gz upstream-660874f45ecf5fd3dc19dd11e2e2006958db3467.tar.bz2 upstream-660874f45ecf5fd3dc19dd11e2e2006958db3467.zip |
madwifi: fix some potential null pointer derefs with wds
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@19322 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/madwifi/patches/451-ibss_race_fix.patch')
-rw-r--r-- | package/madwifi/patches/451-ibss_race_fix.patch | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/package/madwifi/patches/451-ibss_race_fix.patch b/package/madwifi/patches/451-ibss_race_fix.patch index d25d3cc88f..8349b318f2 100644 --- a/package/madwifi/patches/451-ibss_race_fix.patch +++ b/package/madwifi/patches/451-ibss_race_fix.patch @@ -53,13 +53,13 @@ int found = 0; IEEE80211_LOCK_IRQ(vap->iv_ic); -@@ -3568,14 +3561,12 @@ ieee80211_recv_mgmt(struct ieee80211vap +@@ -3570,14 +3563,12 @@ ieee80211_recv_mgmt(struct ieee80211vap } } if (found) - ni = ni_or_null = avp->iv_wdsnode; + tni = ieee80211_ref_node(avp->iv_wdsnode); - } else if (vap->iv_opmode == IEEE80211_M_WDS) { + } else if ((vap->iv_opmode == IEEE80211_M_WDS) && vap->iv_wdsnode) { found = 1; - ni = ni_or_null = vap->iv_wdsnode; - } else if (vap->iv_opmode == IEEE80211_M_IBSS) { @@ -72,7 +72,7 @@ found = 1; } IEEE80211_UNLOCK_IRQ(vap->iv_ic); -@@ -3583,20 +3574,21 @@ ieee80211_recv_mgmt(struct ieee80211vap +@@ -3585,20 +3576,21 @@ ieee80211_recv_mgmt(struct ieee80211vap if (!found) break; @@ -100,7 +100,7 @@ } else { /* * Copy data from beacon to neighbor table. -@@ -3604,39 +3596,38 @@ ieee80211_recv_mgmt(struct ieee80211vap +@@ -3606,39 +3598,38 @@ ieee80211_recv_mgmt(struct ieee80211vap * ieee80211_add_neighbor(), so we just copy * everything over to be safe. */ |