mac80211: fix invalid band deref building preq IEs

The function building probe-request IEs does not validate the band is
supported before dereferencing it. This can result in a panic when
all bands are traversed, as done during sched-scan start.

Warn when this happens and return an empty probe request. Also fix
sched-scan to not waste memory on unsupported bands.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 379f178eab5f..1ff04f689d1f 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -928,6 +928,9 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
         }
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
+                if (!local->hw.wiphy->bands[i])
+                        continue;
+
                 local->sched_scan_ies.ie[i] = kzalloc(2 +
                                                       IEEE80211_MAX_SSID_LEN +
                                                       local->scan_ies_len +