rpms/kernel/F-7 linux-2.6-iwlwifi-cve-2007-5938.patch, NONE, 1.1 kernel-2.6.spec, 1.3389, 1.3390

[John W. Linville (linville)]

Author: linville

Update of /cvs/pkgs/rpms/kernel/F-7
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv26480

Modified Files:
	kernel-2.6.spec 
Added Files:
	linux-2.6-iwlwifi-cve-2007-5938.patch 
Log Message:
Fix NULL ptr reference in iwlwifi (CVE-2007-5938)

linux-2.6-iwlwifi-cve-2007-5938.patch:

--- NEW FILE linux-2.6-iwlwifi-cve-2007-5938.patch ---
diff -up linux-2.6.23.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c.orig linux-2.6.23.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c
--- linux-2.6.23.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c.orig	2007-11-27 13:34:31.000000000 -0500
+++ linux-2.6.23.noarch/drivers/net/wireless/iwlwifi/iwl3945-base.c	2007-11-27 14:20:04.000000000 -0500
@@ -2909,6 +2909,10 @@ static void iwl_set_rate(struct iwl_priv
 	int i;
 
 	hw = iwl_get_hw_mode(priv, priv->phymode);
+	if (!hw) {
+		IWL_ERROR("Failed to set rate: unable to get hw mode\n");
+		return;
+	}
 
 	priv->active_rate = 0;
 	priv->active_rate_basic = 0;
diff -up linux-2.6.23.noarch/drivers/net/wireless/iwlwifi/iwl4965-base.c.orig linux-2.6.23.noarch/drivers/net/wireless/iwlwifi/iwl4965-base.c
--- linux-2.6.23.noarch/drivers/net/wireless/iwlwifi/iwl4965-base.c.orig	2007-11-27 13:34:31.000000000 -0500
+++ linux-2.6.23.noarch/drivers/net/wireless/iwlwifi/iwl4965-base.c	2007-11-27 14:20:41.000000000 -0500
@@ -2998,6 +2998,10 @@ static void iwl_set_rate(struct iwl_priv
 	int i;
 
 	hw = iwl_get_hw_mode(priv, priv->phymode);
+	if (!hw) {
+		IWL_ERROR("Failed to set rate: unable to get hw mode\n");
+		return;
+	}
 
 	priv->active_rate = 0;
 	priv->active_rate_basic = 0;


Index: kernel-2.6.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-7/kernel-2.6.spec,v
retrieving revision 1.3389
retrieving revision 1.3390
diff -u -r1.3389 -r1.3390
--- kernel-2.6.spec	27 Nov 2007 19:21:46 -0000	1.3389
+++ kernel-2.6.spec	27 Nov 2007 19:27:41 -0000	1.3390
@@ -598,6 +598,7 @@
 
 Patch680: linux-2.6-wireless.patch
 Patch682: linux-2.6-bcm43xx-pci-neuter.patch
+Patch683: linux-2.6-iwlwifi-cve-2007-5938.patch
 Patch690: linux-2.6-at76.patch
 Patch691: linux-2.6-ath5k.patch
 Patch693: linux-2.6-zd1211rw-mac80211.patch
@@ -1274,6 +1275,9 @@
 # pre-2.6.25 wireless patches from upstream
 #ApplyPatch linux-2.6-wireless-pending.patch
 
+# fix CVE-2007-5938
+ApplyPatch linux-2.6-iwlwifi-cve-2007-5938.patch
+
 # Add misc wireless bits from upstream wireless tree
 ApplyPatch linux-2.6-at76.patch
 ApplyPatch linux-2.6-ath5k.patch
@@ -2256,6 +2260,9 @@
 %endif
 
 %changelog
+* Tue Nov 27 2007 John W. Linville <linville at redhat.com>
+* Fix NULL ptr reference in iwlwifi (CVE-2007-5938)
+
 * Tue Nov 27 2007 Chuck Ebbert <cebbert at redhat.com>
 - Fix SPDIF audio on AD1988 codec (#253777)