nl80211: fix null-ptr dereference on invalid mesh configuration

If TX rates are specified during mesh join, the channel must
also be specified. Check the channel pointer to avoid a null
pointer dereference if it isn't.

Reported-by: Jouni Malinen <j@w1.fi>
Fixes: 8564e38206de ("cfg80211: add checks for beacon rate, extend to mesh")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index fbd5593e88cb859f212a749955a927915495d498..690874293cfc6103a08eecf096a94184f36868f9 100644 (file)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -9987,6 +9987,9 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
                if (err)
                        return err;
 
+               if (!setup.chandef.chan)
+                       return -EINVAL;
+
                err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
                                              &setup.beacon_rate);
                if (err)