cfg80211: fix a crash in nl80211_send_station

mac80211 leaves sinfo->assoc_req_ies uninitialized, causing a random
pointer memory access in nl80211_send_station.
Instead of checking if the pointer is null, use sinfo->filled, like
the rest of the fields.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 1 insertions, 1 deletions

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ca7697701076..253e56319d7e 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -2236,7 +2236,7 @@ static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
         }
         nla_nest_end(msg, sinfoattr);
 
-        if (sinfo->assoc_req_ies)
+        if (sinfo->filled & STATION_INFO_ASSOC_REQ_IES)
                 NLA_PUT(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
                         sinfo->assoc_req_ies);