Johannes Berg c87905bec5 mac80211: set bss_info data before configuring the channel
When mac80211 changes the channel, it also calls into the driver's
bss_info_changed() callback, e.g. with BSS_CHANGED_IDLE. The driver
may, like iwlwifi does, access more data from bss_info in that case
and iwlwifi accesses the basic_rates bitmap, but if changing from a
band with more (basic) rates to one with fewer, an out-of-bounds
access of the rate array may result.

While we can't avoid having invalid data at some point in time, we
can avoid having it while we call the driver - so set up all the
data before configuring the channel, and then apply it afterwards.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=195677

Reported-by: Johannes Hirte <johannes.hirte@datenkhaos.de>
Tested-by: Johannes Hirte <johannes.hirte@datenkhaos.de>
Debugged-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-06-13 10:24:33 +02:00
..
2014-11-04 13:18:21 +01:00
2014-04-09 14:49:43 +02:00
2017-02-10 14:31:51 -05:00
2015-05-11 19:16:04 +02:00
2017-03-06 09:21:46 +01:00
2014-04-09 14:49:43 +02:00
2017-04-28 11:08:21 +02:00
2017-02-09 15:17:30 +01:00