Search Linux Wireless

Re: NULL pointer deref at wext ioctl (Re: [PATCH] compat-2.6: adding ethtool.h to compat-2.6.31.h)

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, 2009-10-08 at 07:28 +0100, Hin-Tak Leung wrote:

> It looks like it is the 2nd of thes two lines around
> /usr/src/debug/kernel-2.6.30/linux-2.6.30.x86_64/net/wireless/wext.c:448
>  which resulted in the null pointer dereference:
> 
> if (index < dev->wireless_handlers->num_private)
>               return dev->wireless_handlers->private[index];

Ok, that's odd. Is it possible that somehow cfg80211 is picking up an
#ifdef'ed copy of "struct iw_handler_def", and thus the struct it is
defining is simply too small? You can figure that out with debug info,
presumably, but I'm not entirely sure how. Actually maybe nm would tell
you too, if you look for cfg80211_wext_handler.

What I mean is this -- cfg80211 defines cfg80211_wext_handler:

const struct iw_handler_def cfg80211_wext_handler
	.num_standard
	.standard
	.get_wireless_stats

but the core expects
	.num_standard
	.standard
	.num_private
	.num_private_args
	.private
	.private_args
	.get_wireless_stats

as such .num_private ends up non-zero because it's shadowed
by .get_wireles_stats.

johannes

Attachment: signature.asc
Description: This is a digitally signed message part


[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux