2012-01-16 09:41:41

by Yoni Divinsky

[permalink] [raw]
Subject: [PATCH] mac80211: fix tx->skb NULL pointer dereference

In function ieee80211_tx_h_encrypt the var info was
initialized from tx->skb, since the fucntion
is called after the function ieee80211_tx_h_fragment
tx->skb is not valid anymore.

Signed-off-by: Yoni Divinsky <[email protected]>
---
net/mac80211/tx.c | 10 +---------
net/mac80211/wpa.c | 19 +++++++++++++++++++
net/mac80211/wpa.h | 2 ++
3 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index edcd1c7..0a5558a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1001,8 +1001,6 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
static ieee80211_tx_result debug_noinline
ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
{
- struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-
if (!tx->key)
return TX_CONTINUE;

@@ -1017,13 +1015,7 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
case WLAN_CIPHER_SUITE_AES_CMAC:
return ieee80211_crypto_aes_cmac_encrypt(tx);
default:
- /* handle hw-only algorithm */
- if (info->control.hw_key) {
- ieee80211_tx_set_protected(tx);
- return TX_CONTINUE;
- }
- break;
-
+ return ieee80211_crypto_default_encrypt(tx);
}

return TX_DROP;
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 93aab07..3fd65ec 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -643,3 +643,22 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx)

return RX_CONTINUE;
}
+
+ieee80211_tx_result
+ieee80211_crypto_default_encrypt(struct ieee80211_tx_data *tx)
+{
+ struct sk_buff *skb;
+ struct ieee80211_tx_info *info = NULL;
+
+ skb_queue_walk(&tx->skbs, skb) {
+ info = IEEE80211_SKB_CB(skb);
+
+ /* handle hw-only algorithm */
+ if (info == NULL || !info->control.hw_key)
+ return TX_DROP;
+ }
+
+ ieee80211_tx_set_protected(tx);
+
+ return TX_CONTINUE;
+}
diff --git a/net/mac80211/wpa.h b/net/mac80211/wpa.h
index baba060..9d6001a 100644
--- a/net/mac80211/wpa.h
+++ b/net/mac80211/wpa.h
@@ -32,5 +32,7 @@ ieee80211_tx_result
ieee80211_crypto_aes_cmac_encrypt(struct ieee80211_tx_data *tx);
ieee80211_rx_result
ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx);
+ieee80211_tx_result
+ieee80211_crypto_default_encrypt(struct ieee80211_tx_data *tx);

#endif /* WPA_H */
--
1.7.0.4



2012-01-16 12:35:45

by Yoni Divinsky

[permalink] [raw]
Subject: Re: [PATCH] mac80211: fix tx->skb NULL pointer dereference

On Mon, Jan 16, 2012 at 2:21 PM, Johannes Berg
<[email protected]> wrote:
> On Mon, 2012-01-16 at 11:43 +0200, Yoni Divinsky wrote:
>> In function ieee80211_tx_h_encrypt the var info was
>> initialized from tx->skb, since the fucntion
>> is called after the function ieee80211_tx_h_fragment
>> tx->skb is not valid anymore.
>
> Wow, that's quite a while ago, I guess nobody tests WAPI often? :-)
Who said anything about WAPI ;-)
>
>> @@ -1001,8 +1001,6 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
>> ?static ieee80211_tx_result debug_noinline
>> ?ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
>> ?{
>> - ? ? struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
>> -
>> ? ? ? if (!tx->key)
>> ? ? ? ? ? ? ? return TX_CONTINUE;
>>
>> @@ -1017,13 +1015,7 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
>> ? ? ? case WLAN_CIPHER_SUITE_AES_CMAC:
>> ? ? ? ? ? ? ? return ieee80211_crypto_aes_cmac_encrypt(tx);
>> ? ? ? default:
>> - ? ? ? ? ? ? /* handle hw-only algorithm */
>> - ? ? ? ? ? ? if (info->control.hw_key) {
>> - ? ? ? ? ? ? ? ? ? ? ieee80211_tx_set_protected(tx);
>> - ? ? ? ? ? ? ? ? ? ? return TX_CONTINUE;
>> - ? ? ? ? ? ? }
>> - ? ? ? ? ? ? break;
>> -
>> + ? ? ? ? ? ? return ieee80211_crypto_default_encrypt(tx);
>
> How about
> ieee80211_require_hw_crypto() or something like that?
To be consistent with the other encryptions I think it would
be better to use something like: ieee80211_crypto_hw_encrypt(tx)

>
>> +ieee80211_tx_result
>> +ieee80211_crypto_default_encrypt(struct ieee80211_tx_data *tx)
>> +{
>> + ? ? struct sk_buff *skb;
>> + ? ? struct ieee80211_tx_info *info = NULL;
>> +
>> + ? ? skb_queue_walk(&tx->skbs, skb) {
>> + ? ? ? ? ? ? info ?= IEEE80211_SKB_CB(skb);
>> +
>> + ? ? ? ? ? ? /* handle hw-only algorithm */
>> + ? ? ? ? ? ? if (info == NULL || !info->control.hw_key)
>> + ? ? ? ? ? ? ? ? ? ? return TX_DROP;
>
> info == NULL can't happen
I agree,

thanks,
Yoni
>
> johannes
>

2012-01-16 12:21:34

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH] mac80211: fix tx->skb NULL pointer dereference

On Mon, 2012-01-16 at 11:43 +0200, Yoni Divinsky wrote:
> In function ieee80211_tx_h_encrypt the var info was
> initialized from tx->skb, since the fucntion
> is called after the function ieee80211_tx_h_fragment
> tx->skb is not valid anymore.

Wow, that's quite a while ago, I guess nobody tests WAPI often? :-)

> @@ -1001,8 +1001,6 @@ ieee80211_tx_h_stats(struct ieee80211_tx_data *tx)
> static ieee80211_tx_result debug_noinline
> ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
> {
> - struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
> -
> if (!tx->key)
> return TX_CONTINUE;
>
> @@ -1017,13 +1015,7 @@ ieee80211_tx_h_encrypt(struct ieee80211_tx_data *tx)
> case WLAN_CIPHER_SUITE_AES_CMAC:
> return ieee80211_crypto_aes_cmac_encrypt(tx);
> default:
> - /* handle hw-only algorithm */
> - if (info->control.hw_key) {
> - ieee80211_tx_set_protected(tx);
> - return TX_CONTINUE;
> - }
> - break;
> -
> + return ieee80211_crypto_default_encrypt(tx);

How about
ieee80211_require_hw_crypto() or something like that?

> +ieee80211_tx_result
> +ieee80211_crypto_default_encrypt(struct ieee80211_tx_data *tx)
> +{
> + struct sk_buff *skb;
> + struct ieee80211_tx_info *info = NULL;
> +
> + skb_queue_walk(&tx->skbs, skb) {
> + info = IEEE80211_SKB_CB(skb);
> +
> + /* handle hw-only algorithm */
> + if (info == NULL || !info->control.hw_key)
> + return TX_DROP;

info == NULL can't happen

johannes