Johannes Berg 5122565188 wext: fix NULL-ptr-dereference with cfg80211's lack of commit() ...

Since cfg80211 doesn't implement commit, we never really cared about
that code there (and it's configured out w/o CONFIG_WIRELESS_EXT).
After all, since it has no commit, it shouldn't return -EIWCOMMIT to
indicate commit is needed.

However, EIWCOMMIT is actually an alias for EINPROGRESS, which _can_
happen if e.g. we try to change the frequency but we're already in
the process of connecting to some network, and drivers could return
that value (or even cfg80211 itself might).

This then causes us to crash because dev->wireless_handlers is NULL
but we try to check dev->wireless_handlers->standard[0].

Fix this by also checking dev->wireless_handlers. Also simplify the
code a little bit.

Cc: stable@vger.kernel.org
Reported-by: syzbot+444248c79e117bc99f46@syzkaller.appspotmail.com
Reported-by: syzbot+8b2a88a09653d4084179@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20210121171621.2076e4a37d5a.I5d9c72220fe7bb133fb718751da0180a57ecba4e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

2021-01-26 11:59:42 +01:00

..

certs

…

.gitignore

.gitignore: add SPDX License Identifier

2020-03-25 11:50:48 +01:00

ap.c

…

chan.c

cfg80211: remove WDS code

2020-11-11 08:39:13 +01:00

core.c

Merge tag 'mac80211-next-for-net-next-2020-11-13' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2020-11-13 12:03:22 -08:00

core.h

nl80211: validate key indexes for cfg80211_registered_device

2020-12-11 13:20:04 +01:00

debugfs.c

…

debugfs.h

…

ethtool.c

cfg80211: check wiphy driver existence for drvinfo report

2020-02-07 12:53:26 +01:00

ibss.c

mm, treewide: rename kzfree() to kfree_sensitive()

2020-08-07 11:33:22 -07:00

Kconfig

cfg80211: select CONFIG_CRC32

2021-01-05 15:50:36 -08:00

lib80211_crypt_ccmp.c

…

lib80211_crypt_tkip.c

mm, treewide: rename kzfree() to kfree_sensitive()

2020-08-07 11:33:22 -07:00

lib80211_crypt_wep.c

mm, treewide: rename kzfree() to kfree_sensitive()

2020-08-07 11:33:22 -07:00

lib80211.c

lib80211: Remove unused macro DRV_NAME

2020-09-18 11:53:00 +02:00

Makefile

…

mesh.c

cfg80211/mac80211: add mesh_param "mesh_nolearn" to skip path discovery

2020-07-31 09:24:23 +02:00

mlme.c

cfg80211: support immediate reconnect request hint

2020-12-11 13:20:05 +01:00

nl80211.c

Merge tag 'mac80211-next-for-net-next-2020-12-11' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

2020-12-12 10:07:56 -08:00

nl80211.h

cfg80211: support immediate reconnect request hint

2020-12-11 13:20:05 +01:00

ocb.c

…

of.c

…

pmsr.c

nl80211: link recursive netlink nested policy

2020-04-30 17:51:41 -07:00

radiotap.c

wireless: radiotap: fix some kernel-doc

2020-09-28 13:53:05 +02:00

rdev-ops.h

nl80211: add common API to configure SAR power limitations

2020-12-11 13:38:54 +01:00

reg.c

cfg80211: Save the regulatory domain with a lock

2021-01-08 21:03:27 +01:00

reg.h

net: Fix various misspellings of "connect"

2019-10-28 13:41:59 -07:00

scan.c

cfg80211: Update TSF and TSF BSSID for multi BSS

2020-12-11 12:57:02 +01:00

sme.c

net: wireless: Convert to use the preferred fallthrough macro

2020-08-27 11:24:28 +02:00

sysfs.c

…

sysfs.h

…

trace.c

…

trace.h

nl80211: add common API to configure SAR power limitations

2020-12-11 13:38:54 +01:00

util.c

nl80211: validate key indexes for cfg80211_registered_device

2020-12-11 13:20:04 +01:00

wext-compat.c

cfg80211: fix callback type mismatches in wext-compat

2020-12-11 12:50:27 +01:00

wext-compat.h

…

wext-core.c

wext: fix NULL-ptr-dereference with cfg80211's lack of commit()

2021-01-26 11:59:42 +01:00

wext-priv.c

…

wext-proc.c

…

wext-sme.c

mm, treewide: rename kzfree() to kfree_sensitive()

2020-08-07 11:33:22 -07:00

wext-spy.c

…