From 0354299fb1090439092e72a4e3de3e07358c4624 Mon Sep 17 00:00:00 2001 From: Arunk Khandavalli Date: Thu, 30 Aug 2018 00:40:16 +0300 Subject: cfg80211: nl80211_update_ft_ies() to validate NL80211_ATTR_IE commit 4f0223bfe9c3e62d8f45a85f1ef1b18a8a263ef9 upstream. nl80211_update_ft_ies() tried to validate NL80211_ATTR_IE with is_valid_ie_attr() before dereferencing it, but that helper function returns true in case of NULL pointer (i.e., attribute not included). This can result to dereferencing a NULL pointer. Fix that by explicitly checking that NL80211_ATTR_IE is included. Fixes: 355199e02b83 ("cfg80211: Extend support for IEEE 802.11r Fast BSS Transition") Change-Id: Ie7ac476919af2ef4d38ff04b8519ad9bdc5e9ed8 Signed-off-by: Arunk Khandavalli Signed-off-by: Jouni Malinen Signed-off-by: Johannes Berg Signed-off-by: Ben Hutchings --- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 85619fa26..7db8cc634 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -8360,6 +8360,7 @@ static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) return -EOPNOTSUPP; if (!info->attrs[NL80211_ATTR_MDID] || + !info->attrs[NL80211_ATTR_IE] || !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) return -EINVAL; -- cgit v1.2.3