mac80211: fix invalid band deref building preq IEs

The function building probe-request IEs does not validate the band is
supported before dereferencing it. This can result in a panic when
all bands are traversed, as done during sched-scan start.

Warn when this happens and return an empty probe request. Also fix
sched-scan to not waste memory on unsupported bands.

Signed-off-by: Arik Nemtsov <arik@wizery.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

1 files changed, 2 insertions, 0 deletions

diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 64493a7bef1a..596db0c2a113 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -999,6 +999,8 @@ int ieee80211_build_preq_ies(struct ieee80211_local *local, u8 *buffer,
         int ext_rates_len;
 
         sband = local->hw.wiphy->bands[band];
+        if (WARN_ON_ONCE(!sband))
+                return 0;
 
         pos = buffer;